110893 2013-02-26 11:02:36 -0800 Potential crash in YARR JIT generated code when building 64 bit 2013-02-26 11:39:44 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 1 msaboff msaboff oldest_to_newest 842188 0 msaboff 2013-02-26 11:02:36 -0800 The index and length parameters to a generated regular expression match function are unsigned 32 bit ints. The ABI allows them to be any value. We should clear the upper 32 bits. 842195 1 190327 msaboff 2013-02-26 11:07:48 -0800 Created attachment 190327 Patch This patch has already been reviewed. 842228 2 msaboff 2013-02-26 11:39:44 -0800 Committed r144083: <http://trac.webkit.org/changeset/144083> 190327 2013-02-26 11:07:48 -0800 2013-02-26 11:07:48 -0800 Patch 110893.patch text/plain 1629 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTQ0MDc3KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE3IEBA CisyMDEzLTAyLTI2ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIFBvdGVudGlhbCBjcmFzaCBpbiBZQVJSIEpJVCBnZW5lcmF0ZWQgY29kZSB3aGVuIGJ1aWxk aW5nIDY0IGJpdAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/ aWQ9MTEwODkzCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgR2F2aW4gQmFycmFjbG91Z2guCisKKyAg ICAgICAgVGhlIEFCSSBkb2Vzbid0IGRlZmluZSB0aGUgYmVoYXZpb3IgZm9yIHRoZSB1cHBlciBi aXRzIG9mIGEgdmFsdWUgdGhhdCB0YWtlcyBsZXNzIHRoYW4gNjQgYml0cy4KKyAgICAgICAgVGhl cmVmb3JlLCB3ZSB6ZXJvIGV4dGVuZCBib3RoIHRoZSBjb3VudCBhbmQgbGVuZ3RoIHJlZ2lzdGVy cyB0byBhc3N1cmUgdGhhdCB0aGVzZSB1bnNpZ25lZCB2YWx1ZXMKKyAgICAgICAgZG9uJ3QgaGF2 ZSBnYXJiYWdlIHVwcGVyIGJpdHMuCisKKyAgICAgICAgKiB5YXJyL1lhcnJKSVQuY3BwOgorICAg ICAgICAoSlNDOjpZYXJyOjpZYXJyR2VuZXJhdG9yOjpnZW5lcmF0ZUVudGVyKToKKwogMjAxMy0w Mi0yNiAgQW5kcmVhcyBLbGluZyAgPGFrbGluZ0BhcHBsZS5jb20+CiAKICAgICAgICAgVW51c2Vk IFN0cnVjdHVyZSBwcm9wZXJ0eSB0YWJsZXMgd2FzdGUgMTRNQiBvbiBNZW1idXN0ZXIuCkluZGV4 OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUveWFyci9ZYXJySklULmNwcAo9PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBT b3VyY2UvSmF2YVNjcmlwdENvcmUveWFyci9ZYXJySklULmNwcAkocmV2aXNpb24gMTQzOTkzKQor KysgU291cmNlL0phdmFTY3JpcHRDb3JlL3lhcnIvWWFyckpJVC5jcHAJKHdvcmtpbmcgY29weSkK QEAgLTI1MTQsNiArMjUxNCw5IEBAIGNsYXNzIFlhcnJHZW5lcmF0b3IgOiBwcml2YXRlIE1hY3Jv QXNzZW0KICAgICAgICAgcHVzaChYODZSZWdpc3RlcnM6OmVicCk7CiAgICAgICAgIG1vdmUoc3Rh Y2tQb2ludGVyUmVnaXN0ZXIsIFg4NlJlZ2lzdGVyczo6ZWJwKTsKICAgICAgICAgcHVzaChYODZS ZWdpc3RlcnM6OmVieCk7CisgICAgICAgIC8vIFRoZSBBQkkgZG9lc24ndCBndWFyYW50ZWUgdGhl IHVwcGVyIGJpdHMgYXJlIHplcm8gb24gdW5zaWduZWQgYXJndW1lbnRzLCBzbyBjbGVhciB0aGVt IG91cnNlbHZlcy4KKyAgICAgICAgemVyb0V4dGVuZDMyVG9QdHIoaW5kZXgsIGluZGV4KTsKKyAg ICAgICAgemVyb0V4dGVuZDMyVG9QdHIobGVuZ3RoLCBsZW5ndGgpOwogI2VsaWYgQ1BVKFg4NikK ICAgICAgICAgcHVzaChYODZSZWdpc3RlcnM6OmVicCk7CiAgICAgICAgIG1vdmUoc3RhY2tQb2lu dGVyUmVnaXN0ZXIsIFg4NlJlZ2lzdGVyczo6ZWJwKTsK