115188 2013-04-25 10:53:42 -0700 32 Bit: Crash due to RegExpTest nodes not setting result type to Boolean 2013-04-25 15:09:20 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED InRadar P2 Normal --- 1 msaboff msaboff oldest_to_newest 881354 0 msaboff 2013-04-25 10:53:42 -0700 When a RegExp.test() call is made and the result is spilled prior to a consuming Branch, the Branch will fill the the tag and payload, but the spill only stored the payload. Therefore we end up with garbage in the tag register. 881368 1 199690 msaboff 2013-04-25 11:08:17 -0700 Created attachment 199690 Patch Working on test, but can't seem to reduce down to a test that crashes without the fix. Test will be in subsequent patch. 881377 2 199690 ggaren 2013-04-25 11:15:31 -0700 Comment on attachment 199690 Patch r=me 881383 3 199690 ggaren 2013-04-25 11:22:25 -0700 Comment on attachment 199690 Patch I think we could test this just by assigning the result of regexp.test() to a local variable, and then asking if the variable is === true, or === false, depending on the regexp. In theory, the CFA will cause garbage to be stored into the tag of the local variable, causing non-boolean-ness with very high probability. 881398 4 msaboff 2013-04-25 11:34:04 -0700 Committed r149128: <http://trac.webkit.org/changeset/149128> 881572 5 msaboff 2013-04-25 15:09:20 -0700 <rdar://problem/13716112> 199690 2013-04-25 11:08:17 -0700 2013-04-25 11:22:25 -0700 Patch 115188.patch text/plain 1347 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTQ5MTIxKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBA CisyMDEzLTA0LTI1ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIDMyIEJpdDogQ3Jhc2ggZHVlIHRvIFJlZ0V4cFRlc3Qgbm9kZXMgbm90IHNldHRpbmcgcmVz dWx0IHR5cGUgdG8gQm9vbGVhbgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93 X2J1Zy5jZ2k/aWQ9MTE1MTg4CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISku CisKKyAgICAgICAgQ2hhbmdlZCB0aGUgUmVnRXhwVGVzdCBub2RlIHRvIHNldCB0aGUgQWJzdHJh Y3RWYWx1ZSB0byBib29sZWFuLCBzaW5jZSB0aGF0CisgICAgICAgIHdoYXQgaXQgaXMuCisKKyAg ICAgICAgKiBkZmcvREZHQWJzdHJhY3RTdGF0ZS5jcHA6CisgICAgICAgIChKU0M6OkRGRzo6QWJz dHJhY3RTdGF0ZTo6ZXhlY3V0ZUVmZmVjdHMpOgorCiAyMDEzLTA0LTI1ICBKdWxpZW4gQnJpYW5j ZWF1ICA8amJyaWFuY2VhdUBuZHMuY29tPgogCiAgICAgICAgIFJFR1JFU1NJT04ocjEzNzk5NCk6 IFJhbmRvbSBjcmFzaGVzIG9jY3VyIHdpdGggU0g0IEpTQy4KSW5kZXg6IFNvdXJjZS9KYXZhU2Ny aXB0Q29yZS9kZmcvREZHQWJzdHJhY3RTdGF0ZS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0ph dmFTY3JpcHRDb3JlL2RmZy9ERkdBYnN0cmFjdFN0YXRlLmNwcAkocmV2aXNpb24gMTQ4ODk5KQor KysgU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdBYnN0cmFjdFN0YXRlLmNwcAkod29ya2lu ZyBjb3B5KQpAQCAtOTk3LDkgKzk5NywxMiBAQCBib29sIEFic3RyYWN0U3RhdGU6OmV4ZWN1dGVF ZmZlY3RzKHVuc2lnCiAgICAgICAgIGJyZWFrOwogICAgICAgICAgICAgCiAgICAgY2FzZSBSZWdF eHBFeGVjOgotICAgIGNhc2UgUmVnRXhwVGVzdDoKICAgICAgICAgZm9yTm9kZShub2RlKS5tYWtl VG9wKCk7CiAgICAgICAgIGJyZWFrOworCisgICAgY2FzZSBSZWdFeHBUZXN0OgorICAgICAgICBm b3JOb2RlKG5vZGUpLnNldChTcGVjQm9vbGVhbik7CisgICAgICAgIGJyZWFrOwogICAgICAgICAg ICAgCiAgICAgY2FzZSBKdW1wOgogICAgICAgICBicmVhazsK