102286 2012-11-14 14:33:54 -0800 String::append() should handle two 8 bit strings without converting both to 16 bits 2012-11-14 15:05:21 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 1 msaboff msaboff benjamin webkit.review.bot oldest_to_newest 767322 0 msaboff 2012-11-14 14:33:54 -0800 String::append() creates the new concatenated string by calling characters() on both the "this" and argument strings. Given that most strings are 8 bit, both strings will be upconverted to 16 bits and the result will also be 16 bits. This can "leak" 16 bit strings to the rest of WebKit. Instead we should check to see if both strings are 8 bit, we should use the string data directly and create a new 8 bit string. 767330 1 174265 msaboff 2012-11-14 14:42:10 -0800 Created attachment 174265 Patch 767349 2 174265 webkit.review.bot 2012-11-14 15:05:17 -0800 Comment on attachment 174265 Patch Clearing flags on attachment: 174265 Committed r134677: <http://trac.webkit.org/changeset/134677> 767350 3 webkit.review.bot 2012-11-14 15:05:21 -0800 All reviewed patches have been landed. Closing bug. 174265 2012-11-14 14:42:10 -0800 2012-11-14 15:05:16 -0800 Patch 102286.patch text/plain 2031 msaboff SW5kZXg6IFNvdXJjZS9XVEYvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XVEYvQ2hh bmdlTG9nCShyZXZpc2lvbiAxMzQ2NzApCisrKyBTb3VyY2UvV1RGL0NoYW5nZUxvZwkod29ya2lu ZyBjb3B5KQpAQCAtMSwzICsxLDE3IEBACisyMDEyLTExLTE0ICBNaWNoYWVsIFNhYm9mZiAgPG1z YWJvZmZAYXBwbGUuY29tPgorCisgICAgICAgIFN0cmluZzo6YXBwZW5kKCkgc2hvdWxkIGhhbmRs ZSB0d28gOCBiaXQgc3RyaW5ncyB3aXRob3V0IGNvbnZlcnRpbmcgYm90aCB0byAxNiBiaXRzCisg ICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMDIyODYKKwor ICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBJZiBib3RoIHN0 cmluZ3MgYXJlIDggYml0LCB0aGVuIGFsbG9jYXRlIGFuZCBjb3B5IHRvIGEgbmV3IDggYml0IHN0 cmluZy4gIFNpbmNlIG1vc3Qgc3RyaW5ncyBhcmUKKyAgICAgICAgOCBiaXQsIHRoaXMgd2lsbCBz YXZlIHVwIHRvIDN4IHRoZSByZXN1bHRpbmcgc3RyaW5nIGxlbmd0aCBpbiBieXRlcy4gIDJ4IGlz IGR1ZSB0byB0aGUgcG9zc2libGUKKyAgICAgICAgc3Vydml2aW5nIDE2IGJpdCBzb3VyY2Ugc3Ry aW5nIHVwY29udmVyc2lvbiBhbmQgMXggZm9yIHRoZSAxNiBiaXQgcmVzdWx0IG5vdyBiZWluZyA4 IGJpdC4KKworICAgICAgICAqIHd0Zi90ZXh0L1dURlN0cmluZy5jcHA6CisgICAgICAgIChXVEY6 OlN0cmluZzo6YXBwZW5kKToKKwogMjAxMi0xMS0xNCAgQ3NhYmEgT3N6dHJvZ29uw6FjICA8b3Nz eUB3ZWJraXQub3JnPgogCiAgICAgICAgIFtRdF1bQVJNXSBFbmFibGUgdGhlIERGRyBKSVQgb24g QVJNdjcoVGh1bWIyKQpJbmRleDogU291cmNlL1dURi93dGYvdGV4dC9XVEZTdHJpbmcuY3BwCj09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT0KLS0tIFNvdXJjZS9XVEYvd3RmL3RleHQvV1RGU3RyaW5nLmNwcAkocmV2aXNpb24g MTM0NjE5KQorKysgU291cmNlL1dURi93dGYvdGV4dC9XVEZTdHJpbmcuY3BwCSh3b3JraW5nIGNv cHkpCkBAIC0xMDMsNiArMTAzLDE2IEBAIHZvaWQgU3RyaW5nOjphcHBlbmQoY29uc3QgU3RyaW5n JiBzdHIpCiAgICAgLy8gY2FsbCB0byBmYXN0TWFsbG9jIGV2ZXJ5IHNpbmdsZSB0aW1lLgogICAg IGlmIChzdHIubV9pbXBsKSB7CiAgICAgICAgIGlmIChtX2ltcGwpIHsKKyAgICAgICAgICAgIGlm IChtX2ltcGwtPmlzOEJpdCgpICYmIHN0ci5tX2ltcGwtPmlzOEJpdCgpKSB7CisgICAgICAgICAg ICAgICAgTENoYXIqIGRhdGE7CisgICAgICAgICAgICAgICAgaWYgKHN0ci5sZW5ndGgoKSA+IG51 bWVyaWNfbGltaXRzPHVuc2lnbmVkPjo6bWF4KCkgLSBtX2ltcGwtPmxlbmd0aCgpKQorICAgICAg ICAgICAgICAgICAgICBDUkFTSCgpOworICAgICAgICAgICAgICAgIFJlZlB0cjxTdHJpbmdJbXBs PiBuZXdJbXBsID0gU3RyaW5nSW1wbDo6Y3JlYXRlVW5pbml0aWFsaXplZChtX2ltcGwtPmxlbmd0 aCgpICsgc3RyLmxlbmd0aCgpLCBkYXRhKTsKKyAgICAgICAgICAgICAgICBtZW1jcHkoZGF0YSwg bV9pbXBsLT5jaGFyYWN0ZXJzOCgpLCBtX2ltcGwtPmxlbmd0aCgpICogc2l6ZW9mKExDaGFyKSk7 CisgICAgICAgICAgICAgICAgbWVtY3B5KGRhdGEgKyBtX2ltcGwtPmxlbmd0aCgpLCBzdHIuY2hh cmFjdGVyczgoKSwgc3RyLmxlbmd0aCgpICogc2l6ZW9mKExDaGFyKSk7CisgICAgICAgICAgICAg ICAgbV9pbXBsID0gbmV3SW1wbC5yZWxlYXNlKCk7CisgICAgICAgICAgICAgICAgcmV0dXJuOwor ICAgICAgICAgICAgfQogICAgICAgICAgICAgVUNoYXIqIGRhdGE7CiAgICAgICAgICAgICBpZiAo c3RyLmxlbmd0aCgpID4gbnVtZXJpY19saW1pdHM8dW5zaWduZWQ+OjptYXgoKSAtIG1faW1wbC0+ bGVuZ3RoKCkpCiAgICAgICAgICAgICAgICAgQ1JBU0goKTsK