113453 2013-03-27 16:05:10 -0700 CodeCache::m_capacity can becoming negative, producing undefined results in pruneSlowCase 2013-08-13 14:53:26 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 mhahnenberg mhahnenberg ossy simon.fraser oldest_to_newest 864951 0 mhahnenberg 2013-03-27 16:05:10 -0700 I encountered a situation where m_capacity can become negative in pruneSlowCase, which will lead to undefined behavior because we'll hit the end of m_map, but there's no check to make sure that m_map.begin() != m_map.end(). Depending on what it->key gives us, sometimes we'll crash, sometimes we'll get a very big number back from length() which will keep us alive by allowing our size to go below our negative m_size, etc. It doesn't happen during every run, so there's some non-determinism there. And sometimes we'll get zero as the length, which will cause an infinite loop. 864952 1 mhahnenberg 2013-03-27 16:05:26 -0700 <rdar://problem/13519289> 864971 2 195430 mhahnenberg 2013-03-27 16:32:59 -0700 Created attachment 195430 Patch 864972 3 195430 ggaren 2013-03-27 16:34:28 -0700 Comment on attachment 195430 Patch r=me 864975 4 mhahnenberg 2013-03-27 16:35:45 -0700 Committed r147017: <http://trac.webkit.org/changeset/147017> 865230 5 ossy 2013-03-28 01:23:11 -0700 (In reply to comment #4) > Committed r147017: <http://trac.webkit.org/changeset/147017> And the buildfix landed in http://trac.webkit.org/changeset/147079. Thanks Zan. (We could have avoided this build breakage and killing EWS bots if you waited for the EWS bots a little bit more than 3 minutes. Or watched the bots after landing ...) 916898 6 ap 2013-08-13 14:53:26 -0700 *** Bug 112263 has been marked as a duplicate of this bug. *** 195430 2013-03-27 16:32:59 -0700 2013-03-27 16:34:27 -0700 Patch bug-113453-20130327163258.patch text/plain 1357 mhahnenberg SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTQ3MDE2KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBA CisyMDEzLTAzLTI3ICBNYXJrIEhhaG5lbmJlcmcgIDxtaGFobmVuYmVyZ0BhcHBsZS5jb20+CisK KyAgICAgICAgQ29kZUNhY2hlOjptX2NhcGFjaXR5IGNhbiBiZWNvbWluZyBuZWdhdGl2ZSwgcHJv ZHVjaW5nIHVuZGVmaW5lZCByZXN1bHRzIGluIHBydW5lU2xvd0Nhc2UKKyAgICAgICAgaHR0cHM6 Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTExMzQ1MworCisgICAgICAgIFJldmll d2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogcnVudGltZS9Db2RlQ2FjaGUuY3Bw OgorICAgICAgICAoSlNDOjpDb2RlQ2FjaGVNYXA6OnBydW5lU2xvd0Nhc2UpOiBXZSBtYWtlIHN1 cmUgdGhhdCBtX21pbkNhcGFjaXR5IGRvZXNuJ3QgZHJvcCBiZWxvdyB6ZXJvIG5vdy4KKyAgICAg ICAgVGhpcyBwcmV2ZW50cyBtX2NhcGFjaXR5IGZyb20gZG9pbmcgdGhlIHNhbWUuCisKIDIwMTMt MDMtMjcgIEZpbGlwIFBpemxvICA8ZnBpemxvQGFwcGxlLmNvbT4KIAogICAgICAgICBERkcgc2hv dWxkIHVzZSBDaGVja1N0cnVjdHVyZSBmb3IgdHlwZWQgYXJyYXkgY2hlY2tzIHdoZW5ldmVyIHBv c3NpYmxlCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9Db2RlQ2FjaGUuY3Bw Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0NvZGVDYWNoZS5j cHAJKHJldmlzaW9uIDE0NzAxNikKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0Nv ZGVDYWNoZS5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTQwLDcgKzQwLDcgQEAgY29uc3QgZG91Ymxl IENvZGVDYWNoZU1hcDo6d29ya2luZ1NldFRpbQogCiB2b2lkIENvZGVDYWNoZU1hcDo6cHJ1bmVT bG93Q2FzZSgpCiB7Ci0gICAgbV9taW5DYXBhY2l0eSA9IG1fc2l6ZSAtIG1fc2l6ZUF0TGFzdFBy dW5lOworICAgIG1fbWluQ2FwYWNpdHkgPSBzdGQ6Om1heChtX3NpemUgLSBtX3NpemVBdExhc3RQ cnVuZSwgMExMKTsKICAgICBtX3NpemVBdExhc3RQcnVuZSA9IG1fc2l6ZTsKICAgICBtX3RpbWVB dExhc3RQcnVuZSA9IG1vbm90b25pY2FsbHlJbmNyZWFzaW5nVGltZSgpOwogCg==