120278 2013-08-25 16:13:58 -0700 JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage does a check on the length of the ArrayStorage after possible reallocing it 2013-08-26 13:28:03 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 mhahnenberg mhahnenberg ggaren webkit-bug-importer oldest_to_newest 920869 0 mhahnenberg 2013-08-25 16:13:58 -0700 This is causing crashes. 920870 1 209609 mhahnenberg 2013-08-25 16:15:06 -0700 Created attachment 209609 Patch 921042 2 209609 ggaren 2013-08-26 09:32:45 -0700 Comment on attachment 209609 Patch Can you add a test case for this? 921048 3 mhahnenberg 2013-08-26 09:51:48 -0700 (In reply to comment #2) > (From update of attachment 209609 [details]) > Can you add a test case for this? I'm working on one right now. It depends on fixing that issue where Object.defineProperty can't make ProeprtyDescriptor::m_attributes == 0. 921092 4 webkit-bug-importer 2013-08-26 11:07:48 -0700 <rdar://problem/14836008> 921137 5 mhahnenberg 2013-08-26 13:28:03 -0700 Committed r154633: <http://trac.webkit.org/changeset/154633> 209609 2013-08-25 16:15:06 -0700 2013-08-26 09:32:45 -0700 Patch bug-120278-20130825161506.patch text/plain 1742 mhahnenberg SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTU0NTgyKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBA CisyMDEzLTA4LTI1ICBNYXJrIEhhaG5lbmJlcmcgIDxtaGFobmVuYmVyZ0BhcHBsZS5jb20+CisK KyAgICAgICAgSlNPYmplY3Q6OnB1dERpcmVjdEluZGV4QmV5b25kVmVjdG9yTGVuZ3RoV2l0aEFy cmF5U3RvcmFnZSBkb2VzIGEgY2hlY2sgb24gdGhlIGxlbmd0aCBvZiB0aGUgQXJyYXlTdG9yYWdl IGFmdGVyIHBvc3NpYmxlIHJlYWxsb2NpbmcgaXQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTEyMDI3OAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgICogcnVudGltZS9KU09iamVjdC5jcHA6CisgICAgICAgIChK U0M6OkpTT2JqZWN0OjpwdXREaXJlY3RJbmRleEJleW9uZFZlY3Rvckxlbmd0aFdpdGhBcnJheVN0 b3JhZ2UpOgorCiAyMDEzLTA4LTI0ICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CiAK ICAgICAgICAgRmxvYXRUeXBlZEFycmF5QWRhcHRvcjo6dG9KU1ZhbHVlIHNob3VsZCBhbG1vc3Qg Y2VydGFpbmx5IG5vdCB1c2UganNOdW1iZXIoKSBzaW5jZSB0aGF0IGF0dGVtcHRzIGludCBjb252 ZXJzaW9ucwpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvSlNPYmplY3QuY3Bw Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0pTT2JqZWN0LmNw cAkocmV2aXNpb24gMTU0NTc5KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvSlNP YmplY3QuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0yMDU3LDggKzIwNTcsOCBAQCBib29sIEpTT2Jq ZWN0OjpwdXREaXJlY3RJbmRleEJleW9uZFZlY3RvCiAgICAgICAgIGlmIChMSUtFTFkoCiAgICAg ICAgICAgICAgICAgIWF0dHJpYnV0ZXMKICAgICAgICAgICAgICAgICAmJiAoaXNEZW5zZUVub3Vn aEZvclZlY3RvcihpLCBzdG9yYWdlLT5tX251bVZhbHVlc0luVmVjdG9yKSkKLSAgICAgICAgICAg ICAgICAmJiBpbmNyZWFzZVZlY3Rvckxlbmd0aCh2bSwgaSArIDEpCi0gICAgICAgICAgICAgICAg JiYgIWluZGV4SXNTdWZmaWNpZW50bHlCZXlvbmRMZW5ndGhGb3JTcGFyc2VNYXAoaSwgc3RvcmFn ZS0+dmVjdG9yTGVuZ3RoKCkpKSkgeworICAgICAgICAgICAgICAgICYmICFpbmRleElzU3VmZmlj aWVudGx5QmV5b25kTGVuZ3RoRm9yU3BhcnNlTWFwKGksIHN0b3JhZ2UtPnZlY3Rvckxlbmd0aCgp KSkKKyAgICAgICAgICAgICAgICAmJiBpbmNyZWFzZVZlY3Rvckxlbmd0aCh2bSwgaSArIDEpKSB7 CiAgICAgICAgICAgICAvLyBzdWNjZXNzISAtIHJlcmVhZCBtX3N0b3JhZ2Ugc2luY2UgaXQgaGFz IGxpa2VseSBiZWVuIHJlYWxsb2NhdGVkLCBhbmQgc3RvcmUgdG8gdGhlIHZlY3Rvci4KICAgICAg ICAgICAgIHN0b3JhZ2UgPSBhcnJheVN0b3JhZ2UoKTsKICAgICAgICAgICAgIHN0b3JhZ2UtPm1f dmVjdG9yW2ldLnNldCh2bSwgdGhpcywgdmFsdWUpOwo=