107891 2013-01-24 18:12:04 -0800 [V8] Keep a RefPtr<SerializedScriptValue*> when we call serialize()/deserialize() (part 1) 2013-01-25 17:30:14 -0800 1 1 1 Unclassified WebKit WebCore JavaScript 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 haraken haraken abarth inferno webkit.review.bot oldest_to_newest 816053 0 haraken 2013-01-24 18:12:04 -0800 If you use a raw SerializedScriptValue* for serialize()/deserialize(), it can potentially cause a use-after-free. This is because serialize()/deserialize() can destruct a RefPtr of the SerializedScriptValue*, depending on data that is serialized/deserialized. So we should keep a RefPtr<SerializedScriptValue*> when we call serialize()/deserialize(). (See https://bugs.webkit.org/show_bug.cgi?id=107792 for more details.) 816057 1 184628 haraken 2013-01-24 18:13:34 -0800 Created attachment 184628 Patch 816091 2 184628 webkit.review.bot 2013-01-24 19:07:43 -0800 Comment on attachment 184628 Patch Rejecting attachment 184628 from commit-queue. New failing tests: inspector-protocol/debugger-terminate-dedicated-worker-while-paused.html Full output: http://queues.webkit.org/results/16118043 816147 3 184628 webkit.review.bot 2013-01-24 20:58:10 -0800 Comment on attachment 184628 Patch Rejecting attachment 184628 from commit-queue. Failed to run "['/mnt/git/webkit-commit-queue/Tools/Scripts/webkit-patch', '--status-host=queues.webkit.org', '--bot-id=gce-cq-03', 'apply-attachment', '--no-update', '--non-interactive', 184628, '--port=chromium-xvfb']" exit_code: 2 cwd: /mnt/git/webkit-commit-queue Last 500 characters of output: led to run "[u'/mnt/git/webkit-commit-queue/Tools/Scripts/svn-apply', '--force', '--reviewer', 'Abhishek Arya']" exit_code: 2 cwd: /mnt/git/webkit-commit-queue Parsed 2 diffs from patch file(s). patch: **** Can't create file /tmp/pp0bfaeL : No space left on device patch: **** Can't create file /tmp/ppyzXClO : No space left on device Failed to run "[u'/mnt/git/webkit-commit-queue/Tools/Scripts/svn-apply', '--force', '--reviewer', 'Abhishek Arya']" exit_code: 2 cwd: /mnt/git/webkit-commit-queue Full output: http://queues.webkit.org/results/16119088 816163 4 184628 webkit.review.bot 2013-01-24 21:15:11 -0800 Comment on attachment 184628 Patch Rejecting attachment 184628 from commit-queue. Failed to run "['/mnt/git/webkit-commit-queue/Tools/Scripts/webkit-patch', '--status-host=queues.webkit.org', '--bot-id=gce-cq-01', 'apply-attachment', '--no-update', '--non-interactive', 184628, '--port=chromium-xvfb']" exit_code: 2 cwd: /mnt/git/webkit-commit-queue Last 500 characters of output: led to run "[u'/mnt/git/webkit-commit-queue/Tools/Scripts/svn-apply', '--force', '--reviewer', 'Abhishek Arya']" exit_code: 2 cwd: /mnt/git/webkit-commit-queue Parsed 2 diffs from patch file(s). patch: **** Can't create file /tmp/ppX12815 : No space left on device patch: **** Can't create file /tmp/ppD6byI5 : No space left on device Failed to run "[u'/mnt/git/webkit-commit-queue/Tools/Scripts/svn-apply', '--force', '--reviewer', 'Abhishek Arya']" exit_code: 2 cwd: /mnt/git/webkit-commit-queue Full output: http://queues.webkit.org/results/16111335 816204 5 184628 webkit.review.bot 2013-01-24 21:56:47 -0800 Comment on attachment 184628 Patch Rejecting attachment 184628 from commit-queue. Failed to run "['/mnt/git/webkit-commit-queue/Tools/Scripts/webkit-patch', '--status-host=queues.webkit.org', '--bot-id=gce-cq-02', 'apply-attachment', '--no-update', '--non-interactive', 184628, '--port=chromium-xvfb']" exit_code: 2 cwd: /mnt/git/webkit-commit-queue Last 500 characters of output: led to run "[u'/mnt/git/webkit-commit-queue/Tools/Scripts/svn-apply', '--force', '--reviewer', 'Abhishek Arya']" exit_code: 2 cwd: /mnt/git/webkit-commit-queue Parsed 2 diffs from patch file(s). patch: **** Can't create file /tmp/ppkBeIMr : No space left on device patch: **** Can't create file /tmp/ppsZVdwr : No space left on device Failed to run "[u'/mnt/git/webkit-commit-queue/Tools/Scripts/svn-apply', '--force', '--reviewer', 'Abhishek Arya']" exit_code: 2 cwd: /mnt/git/webkit-commit-queue Full output: http://queues.webkit.org/results/16122109 817079 6 184628 webkit.review.bot 2013-01-25 17:30:10 -0800 Comment on attachment 184628 Patch Clearing flags on attachment: 184628 Committed r140887: <http://trac.webkit.org/changeset/140887> 817080 7 webkit.review.bot 2013-01-25 17:30:14 -0800 All reviewed patches have been landed. Closing bug. 184628 2013-01-24 18:13:34 -0800 2013-01-25 17:30:10 -0800 Patch bug-107891-20130125111025.patch text/plain 2244 haraken U3VidmVyc2lvbiBSZXZpc2lvbjogMTQwNzU4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMDlmNWZlYjhlNGJmZmVm NTYwZWJmMGI4NjFkNmRkNTBlMjNhNWVhZS4uNTI3YmE3MTc1ZWQzYTU0YjU1OTg5NjQzMzQ4NDJl ODUzNWZlMGU2OCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIzIEBACisyMDEzLTAxLTI0ICBLZW50 YXJvIEhhcmEgIDxoYXJha2VuQGNocm9taXVtLm9yZz4KKworICAgICAgICBbVjhdIEtlZXAgYSBS ZWZQdHI8U2VyaWFsaXplZFNjcmlwdFZhbHVlKj4gd2hlbiB3ZSBjYWxsIHNlcmlhbGl6ZSgpL2Rl c2VyaWFsaXplKCkgKHBhcnQgMSkKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hv d19idWcuY2dpP2lkPTEwNzg5MQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEp LgorCisgICAgICAgIElmIHlvdSB1c2UgYSByYXcgU2VyaWFsaXplZFNjcmlwdFZhbHVlKiBmb3Ig c2VyaWFsaXplKCkvZGVzZXJpYWxpemUoKSwKKyAgICAgICAgaXQgY2FuIHBvdGVudGlhbGx5IGNh dXNlIGEgdXNlLWFmdGVyLWZyZWUuIFRoaXMgaXMgYmVjYXVzZSBzZXJpYWxpemUoKS8KKyAgICAg ICAgZGVzZXJpYWxpemUoKSBjYW4gZGVzdHJ1Y3QgYSBSZWZQdHIgb2YgdGhlIFNlcmlhbGl6ZWRT Y3JpcHRWYWx1ZSosCisgICAgICAgIGRlcGVuZGluZyBvbiBkYXRhIHRoYXQgaXMgc2VyaWFsaXpl ZC9kZXNlcmlhbGl6ZWQuIFNvIHdlIHNob3VsZCBrZWVwIGEKKyAgICAgICAgUmVmUHRyPFNlcmlh bGl6ZWRTY3JpcHRWYWx1ZSo+IHdoZW4gd2UgY2FsbCBzZXJpYWxpemUoKS9kZXNlcmlhbGl6ZSgp LgorICAgICAgICAoU2VlIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0x MDc3OTIgZm9yIG1vcmUgZGV0YWlscy4pCisKKyAgICAgICAgTm8gdGVzdHMuIFRoaXMgaXMganVz dCBhIGp1c3QtaW4tY2FzZSBmaXguIEkgY291bGRuJ3QgZmluZCBhbnkgYnVnCisgICAgICAgIGV2 ZW4gaW4gYW4gQVNBTiBidWlsZC4KKworICAgICAgICAqIGJpbmRpbmdzL3Y4L2N1c3RvbS9WOEN1 c3RvbUV2ZW50Q3VzdG9tLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlY4Q3VzdG9tRXZlbnQ6OmRl dGFpbEFjY2Vzc29yR2V0dGVyKToKKwogMjAxMy0wMS0yNCAgQmV0aCBEYWtpbiAgPGJkYWtpbkBh cHBsZS5jb20+CiAKICAgICAgICAgRml4ZWQgZWxlbWVudHMgc29tZXRpbWVzIG1hcmtlZCBvdXQt b2YtdmlldyBpZiB5b3UgaGF2ZSBydWJiZXItYmFuZGVkIHRvbyBmYXIsIApkaWZmIC0tZ2l0IGEv U291cmNlL1dlYkNvcmUvYmluZGluZ3MvdjgvY3VzdG9tL1Y4Q3VzdG9tRXZlbnRDdXN0b20uY3Bw IGIvU291cmNlL1dlYkNvcmUvYmluZGluZ3MvdjgvY3VzdG9tL1Y4Q3VzdG9tRXZlbnRDdXN0b20u Y3BwCmluZGV4IGFhNTg2OTFkMWIyZDE0ZTFiOGNhMjI3NzljNDZjNzY4OGNhY2UyZDYuLjg1YjZm YjBhNjZmMWFmYjAyYTcyMGRmNjYxYjRlMzM5ZTU0YTMxMGMgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9X ZWJDb3JlL2JpbmRpbmdzL3Y4L2N1c3RvbS9WOEN1c3RvbUV2ZW50Q3VzdG9tLmNwcAorKysgYi9T b3VyY2UvV2ViQ29yZS9iaW5kaW5ncy92OC9jdXN0b20vVjhDdXN0b21FdmVudEN1c3RvbS5jcHAK QEAgLTQ5LDcgKzQ5LDcgQEAgbmFtZXNwYWNlIFdlYkNvcmUgewogdjg6OkhhbmRsZTx2ODo6VmFs dWU+IFY4Q3VzdG9tRXZlbnQ6OmRldGFpbEFjY2Vzc29yR2V0dGVyKHY4OjpMb2NhbDx2ODo6U3Ry aW5nPiBuYW1lLCBjb25zdCB2ODo6QWNjZXNzb3JJbmZvJiBpbmZvKQogewogICAgIEN1c3RvbUV2 ZW50KiBpbXAgPSBWOEN1c3RvbUV2ZW50Ojp0b05hdGl2ZShpbmZvLkhvbGRlcigpKTsKLSAgICBT ZXJpYWxpemVkU2NyaXB0VmFsdWUqIHNlcmlhbGl6ZWQgPSBpbXAtPnNlcmlhbGl6ZWRTY3JpcHRW YWx1ZSgpLmdldCgpOworICAgIFJlZlB0cjxTZXJpYWxpemVkU2NyaXB0VmFsdWU+IHNlcmlhbGl6 ZWQgPSBpbXAtPnNlcmlhbGl6ZWRTY3JpcHRWYWx1ZSgpOwogICAgIGlmIChzZXJpYWxpemVkKSB7 CiAgICAgICAgIHY4OjpIYW5kbGU8djg6OlZhbHVlPiB2YWx1ZSA9IGluZm8uSG9sZGVyKCktPkdl dEhpZGRlblZhbHVlKFY4SGlkZGVuUHJvcGVydHlOYW1lOjpkZXRhaWwoKSk7CiAgICAgICAgIGlm ICh2YWx1ZS5Jc0VtcHR5KCkpIHsK