189855 2018-09-21 13:35:15 -0700 JSRopeString::resolveRope() wrongly assumes that tryGetValue() passes it a valid ExecState. 2018-09-22 15:20:57 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 189558 1 mark.lam mark.lam ap commit-queue fpizlo graouts keith_miller msaboff realdawei rmorisset saam tzagallo webkit-bug-importer ysuzuki oldest_to_newest 1462056 0 mark.lam 2018-09-21 13:35:15 -0700 <rdar://problem/44680181> 1462061 1 350418 mark.lam 2018-09-21 13:45:22 -0700 Created attachment 350418 proposed patch. 1462137 2 350418 mark.lam 2018-09-21 15:52:40 -0700 Comment on attachment 350418 proposed patch. Thanks for the review. Landing now. 1462156 3 350418 commit-queue 2018-09-21 16:18:24 -0700 Comment on attachment 350418 proposed patch. Clearing flags on attachment: 350418 Committed r236369: <https://trac.webkit.org/changeset/236369> 1462157 4 commit-queue 2018-09-21 16:18:26 -0700 All reviewed patches have been landed. Closing bug. 1462365 5 ysuzuki 2018-09-22 04:58:01 -0700 Oops, thank you for fixing it!!! 1462421 6 ap 2018-09-22 15:17:19 -0700 *** Bug 189830 has been marked as a duplicate of this bug. *** 1462423 7 350418 ap 2018-09-22 15:20:05 -0700 Comment on attachment 350418 proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=350418&action=review > Source/JavaScriptCore/ChangeLog:3 > + JSRopeString::resolveRope() wrongly assumes that tryGetValue() passes it a valid ExecState. What's the test coverage for this fix? Per Dawei's comment in bug 189558, Speedometer started to crash, but did regression tests crash too? It would be less than ideal if a performance test remained our only defense. 350418 2018-09-21 13:45:22 -0700 2018-09-21 16:18:24 -0700 proposed patch. bug-189855.patch text/plain 5753 mark.lam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjM2MzU3KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI0IEBA CisyMDE4LTA5LTIxICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBK U1JvcGVTdHJpbmc6OnJlc29sdmVSb3BlKCkgd3JvbmdseSBhc3N1bWVzIHRoYXQgdHJ5R2V0VmFs dWUoKSBwYXNzZXMgaXQgYSB2YWxpZCBFeGVjU3RhdGUuCisgICAgICAgIGh0dHBzOi8vYnVncy53 ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xODk4NTUKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVt LzQ0NjgwMTgxPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAg ICAgIHRyeUdldFZhbHVlKCkgYWx3YXlzIHBhc3NlcyBhIG51bGxwdHIgdG8gSlNSb3BlU3RyaW5n OjpyZXNvbHZlUm9wZSgpIGZvciB0aGUKKyAgICAgICAgRXhlY1N0YXRlKiBhcmd1bWVudC4gIFRo aXMgaXMgaW50ZW50aW9uYWwgc28gdGhhdCByZXNvbHZlUm9wZSgpIGRvZXMgbm90IHRocm93Cisg ICAgICAgIGluIHRoZSBldmVudCBvZiBhbiBPdXRPZk1lbW9yeSBlcnJvci4gIEhlbmNlLCBKU1Jv cGVTdHJpbmc6OnJlc29sdmVSb3BlKCkgc2hvdWxkCisgICAgICAgIGdldCB0aGUgVk0gZnJvbSB0 aGUgY2VsbCBpbnN0ZWFkIG9mIHZpYSB0aGUgRXhlY1N0YXRlLgorCisgICAgICAgIEFsc28gcmVt b3ZlZCBhbiBvYnNvbGV0ZSBhbmQgdW51c2VkIGZpZWxkIGluIEpTU3RyaW5nLgorCisgICAgICAg ICogcnVudGltZS9KU1N0cmluZy5jcHA6CisgICAgICAgIChKU0M6OkpTUm9wZVN0cmluZzo6cmVz b2x2ZVJvcGUgY29uc3QpOgorICAgICAgICAoSlNDOjpKU1JvcGVTdHJpbmc6Om91dE9mTWVtb3J5 IGNvbnN0KToKKyAgICAgICAgKiBydW50aW1lL0pTU3RyaW5nLmg6CisgICAgICAgIChKU0M6OkpT U3RyaW5nOjp0cnlHZXRWYWx1ZSBjb25zdCk6CisKIDIwMTgtMDktMjEgIFRydWl0dCBTYXZlbGwg IDx0c2F2ZWxsQGFwcGxlLmNvbT4KIAogICAgICAgICBSZWJhc2VsaW5lIHRlc3RzIGFmdGVyIGNo YW5nZXMgaW4gaHR0cHM6Ly90cmFjLndlYmtpdC5vcmcvY2hhbmdlc2V0LzIzNjMyMS93ZWJraXQK SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0pTU3RyaW5nLmNwcAo9PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9KU1N0cmluZy5jcHAJKHJldmlz aW9uIDIzNjM1NykKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0pTU3RyaW5nLmNw cAkod29ya2luZyBjb3B5KQpAQCAtMjUwLDcgKzI1MCw3IEBAIFJlZlB0cjxBdG9taWNTdHJpbmdJ bXBsPiBKU1JvcGVTdHJpbmc6OnIKICAgICByZXR1cm4gbnVsbHB0cjsKIH0KIAotdm9pZCBKU1Jv cGVTdHJpbmc6OnJlc29sdmVSb3BlKEV4ZWNTdGF0ZSogZXhlYykgY29uc3QKK3ZvaWQgSlNSb3Bl U3RyaW5nOjpyZXNvbHZlUm9wZShFeGVjU3RhdGUqIG51bGxPckV4ZWNGb3JPT00pIGNvbnN0CiB7 CiAgICAgQVNTRVJUKGlzUm9wZSgpKTsKICAgICAKQEAgLTI2NCwxMCArMjY0LDEwIEBAIHZvaWQg SlNSb3BlU3RyaW5nOjpyZXNvbHZlUm9wZShFeGVjU3RhdGUKICAgICBpZiAoaXM4Qml0KCkpIHsK ICAgICAgICAgTENoYXIqIGJ1ZmZlcjsKICAgICAgICAgaWYgKGF1dG8gbmV3SW1wbCA9IFN0cmlu Z0ltcGw6OnRyeUNyZWF0ZVVuaW5pdGlhbGl6ZWQobGVuZ3RoKCksIGJ1ZmZlcikpIHsKLSAgICAg ICAgICAgIGV4ZWMtPnZtKCkuaGVhcC5yZXBvcnRFeHRyYU1lbW9yeUFsbG9jYXRlZChuZXdJbXBs LT5jb3N0KCkpOworICAgICAgICAgICAgSGVhcDo6aGVhcCh0aGlzKS0+cmVwb3J0RXh0cmFNZW1v cnlBbGxvY2F0ZWQobmV3SW1wbC0+Y29zdCgpKTsKICAgICAgICAgICAgIG1fdmFsdWUgPSBXVEZN b3ZlKG5ld0ltcGwpOwogICAgICAgICB9IGVsc2UgewotICAgICAgICAgICAgb3V0T2ZNZW1vcnko ZXhlYyk7CisgICAgICAgICAgICBvdXRPZk1lbW9yeShudWxsT3JFeGVjRm9yT09NKTsKICAgICAg ICAgICAgIHJldHVybjsKICAgICAgICAgfQogICAgICAgICByZXNvbHZlUm9wZUludGVybmFsOE5v U3Vic3RyaW5nKGJ1ZmZlcik7CkBAIC0yNzgsMTAgKzI3OCwxMCBAQCB2b2lkIEpTUm9wZVN0cmlu Zzo6cmVzb2x2ZVJvcGUoRXhlY1N0YXRlCiAgICAgCiAgICAgVUNoYXIqIGJ1ZmZlcjsKICAgICBp ZiAoYXV0byBuZXdJbXBsID0gU3RyaW5nSW1wbDo6dHJ5Q3JlYXRlVW5pbml0aWFsaXplZChsZW5n dGgoKSwgYnVmZmVyKSkgewotICAgICAgICBleGVjLT52bSgpLmhlYXAucmVwb3J0RXh0cmFNZW1v cnlBbGxvY2F0ZWQobmV3SW1wbC0+Y29zdCgpKTsKKyAgICAgICAgSGVhcDo6aGVhcCh0aGlzKS0+ cmVwb3J0RXh0cmFNZW1vcnlBbGxvY2F0ZWQobmV3SW1wbC0+Y29zdCgpKTsKICAgICAgICAgbV92 YWx1ZSA9IFdURk1vdmUobmV3SW1wbCk7CiAgICAgfSBlbHNlIHsKLSAgICAgICAgb3V0T2ZNZW1v cnkoZXhlYyk7CisgICAgICAgIG91dE9mTWVtb3J5KG51bGxPckV4ZWNGb3JPT00pOwogICAgICAg ICByZXR1cm47CiAgICAgfQogICAgIApAQCAtMzgwLDE2ICszODAsMTYgQEAgdm9pZCBKU1JvcGVT dHJpbmc6OnJlc29sdmVSb3BlU2xvd0Nhc2UoVQogICAgIEFTU0VSVChidWZmZXIgPT0gcG9zaXRp b24pOwogfQogCi12b2lkIEpTUm9wZVN0cmluZzo6b3V0T2ZNZW1vcnkoRXhlY1N0YXRlKiBleGVj KSBjb25zdAordm9pZCBKU1JvcGVTdHJpbmc6Om91dE9mTWVtb3J5KEV4ZWNTdGF0ZSogbnVsbE9y RXhlY0Zvck9PTSkgY29uc3QKIHsKLSAgICBWTSYgdm0gPSBleGVjLT52bSgpOwotICAgIGF1dG8g c2NvcGUgPSBERUNMQVJFX1RIUk9XX1NDT1BFKHZtKTsKLQogICAgIGNsZWFyRmliZXJzKCk7CiAg ICAgQVNTRVJUKGlzUm9wZSgpKTsKICAgICBBU1NFUlQobV92YWx1ZS5pc051bGwoKSk7Ci0gICAg aWYgKGV4ZWMpCi0gICAgICAgIHRocm93T3V0T2ZNZW1vcnlFcnJvcihleGVjLCBzY29wZSk7Cisg ICAgaWYgKG51bGxPckV4ZWNGb3JPT00pIHsKKyAgICAgICAgVk0mIHZtID0gbnVsbE9yRXhlY0Zv ck9PTS0+dm0oKTsKKyAgICAgICAgYXV0byBzY29wZSA9IERFQ0xBUkVfVEhST1dfU0NPUEUodm0p OworICAgICAgICB0aHJvd091dE9mTWVtb3J5RXJyb3IobnVsbE9yRXhlY0Zvck9PTSwgc2NvcGUp OworICAgIH0KIH0KIAogSlNWYWx1ZSBKU1N0cmluZzo6dG9QcmltaXRpdmUoRXhlY1N0YXRlKiwg UHJlZmVycmVkUHJpbWl0aXZlVHlwZSkgY29uc3QKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29y ZS9ydW50aW1lL0pTU3RyaW5nLmgKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3Jl L3J1bnRpbWUvSlNTdHJpbmcuaAkocmV2aXNpb24gMjM2MzU3KQorKysgU291cmNlL0phdmFTY3Jp cHRDb3JlL3J1bnRpbWUvSlNTdHJpbmcuaAkod29ya2luZyBjb3B5KQpAQCAtMTU5LDcgKzE1OSw3 IEBAIHB1YmxpYzoKIAogICAgIGlubGluZSBib29sIGVxdWFsKEV4ZWNTdGF0ZSosIEpTU3RyaW5n KiBvdGhlcikgY29uc3Q7CiAgICAgY29uc3QgU3RyaW5nJiB2YWx1ZShFeGVjU3RhdGUqKSBjb25z dDsKLSAgICBjb25zdCBTdHJpbmcmIHRyeUdldFZhbHVlKCkgY29uc3Q7CisgICAgaW5saW5lIGNv bnN0IFN0cmluZyYgdHJ5R2V0VmFsdWUoKSBjb25zdDsKICAgICBjb25zdCBTdHJpbmdJbXBsKiB0 cnlHZXRWYWx1ZUltcGwoKSBjb25zdDsKICAgICBBTFdBWVNfSU5MSU5FIHVuc2lnbmVkIGxlbmd0 aCgpIGNvbnN0IHsgcmV0dXJuIG1fbGVuZ3RoOyB9CiAKQEAgLTIxOCw3ICsyMTgsNiBAQCBwcml2 YXRlOgogICAgIG11dGFibGUgdWludDE2X3QgbV9mbGFncyB7IDAgfTsKICAgICAvLyBUaGUgcG9p c29uIGlzIHN0cmF0ZWdpY2FsbHkgcGxhY2VkIGFuZCBob2xkcyBhIHZhbHVlIHN1Y2ggdGhhdCB0 aGUgZmlyc3QKICAgICAvLyA2NCBiaXRzIG9mIEpTU3RyaW5nIGxvb2sgbGlrZSBhIGRvdWJsZSBK U1ZhbHVlLgotICAgIHVpbnQxNl90IG1fcG9pc29uIHsgMSB9OwogICAgIG11dGFibGUgU3RyaW5n IG1fdmFsdWU7CiAKICAgICBmcmllbmQgY2xhc3MgTExJbnRPZmZzZXRzRXh0cmFjdG9yOwpAQCAt NDE4LDEyICs0MTcsMTQgQEAgcHJpdmF0ZToKICAgICBmcmllbmQgSlNWYWx1ZSBqc1N0cmluZ0Zy b21SZWdpc3RlckFycmF5KEV4ZWNTdGF0ZSosIFJlZ2lzdGVyKiwgdW5zaWduZWQpOwogICAgIGZy aWVuZCBKU1ZhbHVlIGpzU3RyaW5nRnJvbUFyZ3VtZW50cyhFeGVjU3RhdGUqLCBKU1ZhbHVlKTsK IAotICAgIEpTX0VYUE9SVF9QUklWQVRFIHZvaWQgcmVzb2x2ZVJvcGUoRXhlY1N0YXRlKikgY29u c3Q7CisgICAgLy8gSWYgbnVsbE9yRXhlY0Zvck9PTSBpcyBudWxsLCByZXNvbHZlUm9wZSgpIHdp bGwgYmUgZG8gbm90aGluZyBpbiB0aGUgZXZlbnQgb2YgYW4gT09NIGVycm9yLgorICAgIC8vIFRo ZSByb3BlIHZhbHVlIHdpbGwgcmVtYWluIGEgbnVsbCBzdHJpbmcgaW4gdGhhdCBjYXNlLgorICAg IEpTX0VYUE9SVF9QUklWQVRFIHZvaWQgcmVzb2x2ZVJvcGUoRXhlY1N0YXRlKiBudWxsT3JFeGVj Rm9yT09NKSBjb25zdDsKICAgICBKU19FWFBPUlRfUFJJVkFURSB2b2lkIHJlc29sdmVSb3BlVG9B dG9taWNTdHJpbmcoRXhlY1N0YXRlKikgY29uc3Q7CiAgICAgSlNfRVhQT1JUX1BSSVZBVEUgUmVm UHRyPEF0b21pY1N0cmluZ0ltcGw+IHJlc29sdmVSb3BlVG9FeGlzdGluZ0F0b21pY1N0cmluZyhF eGVjU3RhdGUqKSBjb25zdDsKICAgICB2b2lkIHJlc29sdmVSb3BlU2xvd0Nhc2U4KExDaGFyKikg Y29uc3Q7CiAgICAgdm9pZCByZXNvbHZlUm9wZVNsb3dDYXNlKFVDaGFyKikgY29uc3Q7Ci0gICAg dm9pZCBvdXRPZk1lbW9yeShFeGVjU3RhdGUqKSBjb25zdDsKKyAgICB2b2lkIG91dE9mTWVtb3J5 KEV4ZWNTdGF0ZSogbnVsbE9yRXhlY0Zvck9PTSkgY29uc3Q7CiAgICAgdm9pZCByZXNvbHZlUm9w ZUludGVybmFsOChMQ2hhciopIGNvbnN0OwogICAgIHZvaWQgcmVzb2x2ZVJvcGVJbnRlcm5hbDhO b1N1YnN0cmluZyhMQ2hhciopIGNvbnN0OwogICAgIHZvaWQgcmVzb2x2ZVJvcGVJbnRlcm5hbDE2 KFVDaGFyKikgY29uc3Q7CkBAIC01NDgsOCArNTQ5LDEwIEBAIGlubGluZSBjb25zdCBTdHJpbmcm IEpTU3RyaW5nOjp2YWx1ZShFeGUKIAogaW5saW5lIGNvbnN0IFN0cmluZyYgSlNTdHJpbmc6OnRy eUdldFZhbHVlKCkgY29uc3QKIHsKLSAgICBpZiAoaXNSb3BlKCkpCi0gICAgICAgIHN0YXRpY19j YXN0PGNvbnN0IEpTUm9wZVN0cmluZyo+KHRoaXMpLT5yZXNvbHZlUm9wZSgwKTsKKyAgICBpZiAo aXNSb3BlKCkpIHsKKyAgICAgICAgLy8gUGFzcyBudWxscHRyIGZvciB0aGUgRXhlY1N0YXRlIHNv IHRoYXQgcmVzb2x2ZVJvcGUgZG9lcyBub3QgdGhyb3cgaW4gdGhlIGV2ZW50IG9mIGFuIE9PTSBl cnJvci4KKyAgICAgICAgc3RhdGljX2Nhc3Q8Y29uc3QgSlNSb3BlU3RyaW5nKj4odGhpcyktPnJl c29sdmVSb3BlKG51bGxwdHIpOworICAgIH0KICAgICByZXR1cm4gbV92YWx1ZTsKIH0KIAo=