| Summary: | REGRESSION (r208953): TemplateObjectDescriptor constructor calculates m_hash on use-after-move variable | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | David Kilzer (:ddkilzer) <ddkilzer> | ||||
| Component: | JavaScriptCore | Assignee: | Yusuke Suzuki <ysuzuki> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | commit-queue, ews-watchlist, keith_miller, mark.lam, msaboff, saam, webkit-bug-importer, ysuzuki | ||||
| Priority: | P2 | Keywords: | InRadar | ||||
| Version: | WebKit Nightly Build | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Bug Depends on: | 164898 | ||||||
| Bug Blocks: | |||||||
| Attachments: |
|
||||||
Regressed in r208953: Bug 164898: Crash in com.apple.JavaScriptCore: WTF::ThreadSpecific<WTF::WTFThreadData, + 142 <https://bugs.webkit.org/show_bug.cgi?id=164898> <https://trac.webkit.org/changeset/208953/webkit> Oops! Created attachment 346593 [details]
Patch v1
Not sure how to write a test for this.
(In reply to David Kilzer (:ddkilzer) from comment #3) > Created attachment 346593 [details] > Patch v1 > > Not sure how to write a test for this. Also not sure of the user visible effect. Just poor performance when looking up items in the hash? Comment on attachment 346593 [details]
Patch v1
r=me
(In reply to David Kilzer (:ddkilzer) from comment #5) > (In reply to David Kilzer (:ddkilzer) from comment #3) > > Created attachment 346593 [details] > > Patch v1 > > > > Not sure how to write a test for this. > > Also not sure of the user visible effect. Just poor performance when > looking up items in the hash? I think so. Calculating a hash on empty vector (moved). Comment on attachment 346593 [details] Patch v1 Clearing flags on attachment: 346593 Committed r234580: <https://trac.webkit.org/changeset/234580> All reviewed patches have been landed. Closing bug. |
TemplateObjectDescriptor constructor calculates m_hash on use-after-move variable: inline TemplateObjectDescriptor::TemplateObjectDescriptor(StringVector&& rawStrings, OptionalStringVector&& cookedStrings) : m_rawStrings(WTFMove(rawStrings)) , m_cookedStrings(WTFMove(cookedStrings)) , m_hash(calculateHash(rawStrings)) { } It should probably use m_rawstrings instead.