134346 2014-06-26 08:02:28 -0700 iOS 8 beta 2 ES6 'Set' clear() broken 2014-07-15 14:38:34 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) iPhone / iPad Other RESOLVED FIXED http://www.scirra.com/labs/bugs/testset.html P2 Major --- 1 ashley benjamin benjamin bunhere cdumez commit-queue gyuyoung.kim oliver sergio oldest_to_newest 1018628 0 ashley 2014-06-26 08:02:28 -0700 Visit the test URL above. In iOS 8 beta 2, 'Set' is present, but broken. Note the last test logs "FAIL: Set does not contain item3". This means after a call to clear(), the size is 0 but it still returns true when calling has() on one of the items. Reproduces on iOS 8 in both Safari and the web view. Does not reproduce on Firefox desktop or Firefox Android, IE11, or Chrome with experimental Javascript enabled. Rating this as 'Major' because the Construct 2 HTML5 game engine (www.scirra.com) already has thousands of games deployed over the web which feature-detect 'Set' and if present, uses it for various internal engine structures; if it is not present, it uses a shim based around setting and deleting object properties. We can work around this in our engine, but the bug has catastrophic consequences for large amounts of existing web content using the Construct 2 engine, since it relies heavily on Sets in crucial parts of the engine to the extent that the broken Set ruins gameplay (objects not destroyed, sounds stuck playing in loops, other unpredictable consequences). Therefore 'Set' either needs to be fixed or removed entirely to prevent breaking lots of games. 1018710 1 oliver 2014-06-26 12:39:42 -0700 Sigh. This is a dumb mistake - MapData::clear is not clearing m_cellKeyedTable - probably fallout from when i fixed the hash-timing attack. Ben, i'm currently stuck on other things any chance you're able to fix this? 1018719 2 benjamin 2014-06-26 13:06:12 -0700 (In reply to comment #1) > Sigh. This is a dumb mistake - MapData::clear is not clearing m_cellKeyedTable - probably fallout from when i fixed the hash-timing attack. Ben, i'm currently stuck on other things any chance you're able to fix this? Sounds good, I'll have a look. 1018820 3 233950 benjamin 2014-06-26 18:02:46 -0700 Created attachment 233950 Patch 1018830 4 233950 oliver 2014-06-26 18:42:06 -0700 Comment on attachment 233950 Patch Could you also add tests for Map? (i realise that they both just use MapData, but it would be good to have explicit tests of each in case that ever changes) 1018831 5 benjamin 2014-06-26 18:44:41 -0700 (In reply to comment #4) > (From update of attachment 233950 [details]) > Could you also add tests for Map? (i realise that they both just use MapData, but it would be good to have explicit tests of each in case that ever changes) Sure. I'll clone the test and adapt it for Map on landing. Thanks for the review. 1018852 6 benjamin 2014-06-26 20:21:03 -0700 Committed r170517: <http://trac.webkit.org/changeset/170517> 1022464 7 ashley 2014-07-15 06:57:14 -0700 Still reproduces in iOS 8 beta 3. Was this pushed back to the next beta? 1022568 8 benjamin 2014-07-15 14:38:34 -0700 (In reply to comment #7) > Still reproduces in iOS 8 beta 3. Was this pushed back to the next beta? I don't track the beta branches, but given the timing it seems normal this did not make it to the stabilization branch. For now, please try WebKit Nightly to make sure everything works as expected. This patch should make it to the next beta. 233950 2014-06-26 18:02:46 -0700 2014-06-26 18:42:05 -0700 Patch bug-134346-20140626180224.patch text/plain 5864 benjamin U3VidmVyc2lvbiBSZXZpc2lvbjogMTcwNDkyCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCAw ZmZmMWIwOTUxNWU0NDhiYjFhYTg1MjljY2RiOGFiYjU3YWJlOWIxLi42YWRjNDU5NWY0YzQ4YzMz Mzc2YWY4NzBiNzRjYWQ4OTYzNjg0YTE2IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxOCBAQAorMjAxNC0wNi0yNiAgQmVuamFtaW4gUG91bGFpbiAgPGJlbmphbWluQHdlYmtp dC5vcmc+CisKKyAgICAgICAgaU9TIDggYmV0YSAyIEVTNiAnU2V0JyBjbGVhcigpIGJyb2tlbgor ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTM0MzQ2CisK KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVGhlIG9iamVj dCBtYXAgd2FzIG5vdCBjbGVhcmVkIDooLgorCisgICAgICAgIEt1ZG9zIHRvIEFzaGxleSBHdWxs ZW4gZm9yIHRyYWNraW5nIHRoaXMgYW5kIG1ha2luZyBhIHJlZ3Jlc3Npb24gdGVzdC4KKyAgICAg ICAgQ3JlZGl0IHRvIE9saXZlciBmb3IgZmluZGluZyB0aGUgbWlzc2luZyBjb2RlLgorCisgICAg ICAgICogcnVudGltZS9NYXBEYXRhLmg6CisgICAgICAgIChKU0M6Ok1hcERhdGE6OmNsZWFyKToK KwogMjAxNC0wNi0yNSAgQnJlbnQgRnVsZ2hhbSAgPGJmdWxnaGFtQGFwcGxlLmNvbT4KIAogICAg ICAgICBbV2luXSBFeHBvc2UgQ2FjaGUgSW5mb3JtYXRpb24gdG8gV2luTGF1bmNoZXIKZGlmZiAt LWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL01hcERhdGEuaCBiL1NvdXJjZS9K YXZhU2NyaXB0Q29yZS9ydW50aW1lL01hcERhdGEuaAppbmRleCA1YzRhNDRkMzE2MjRlYjhjODJk YjQ0NGE5MjFkNTEzZjYxMDk1NDc0Li43NWI0YzZkYWIwMTQ3NDcwMDkwNWE2MzE0NDdlZjlmM2Uw MWRlY2NmIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9NYXBEYXRh LmgKKysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvTWFwRGF0YS5oCkBAIC0xNDIs MTIgKzE0MiwxMyBAQCBwcml2YXRlOgogCiBBTFdBWVNfSU5MSU5FIHZvaWQgTWFwRGF0YTo6Y2xl YXIoKQogeworICAgIG1fY2VsbEtleWVkVGFibGUuY2xlYXIoKTsKICAgICBtX3ZhbHVlS2V5ZWRU YWJsZS5jbGVhcigpOwogICAgIG1fc3RyaW5nS2V5ZWRUYWJsZS5jbGVhcigpOwogICAgIG1fY2Fw YWNpdHkgPSAwOwogICAgIG1fc2l6ZSA9IDA7CiAgICAgbV9kZWxldGVkQ291bnQgPSAwOwotICAg IG1fZW50cmllcyA9IDA7CisgICAgbV9lbnRyaWVzID0gbnVsbHB0cjsKIH0KIAogQUxXQVlTX0lO TElORSBNYXBEYXRhOjpLZXlUeXBlOjpLZXlUeXBlKEpTVmFsdWUgdikKZGlmZiAtLWdpdCBhL0xh eW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCAwODQwNTc0 ZTUyMzdkNTBjMGI0ZDYwYjA5ZjRlM2M1MDYzZjI5ZWRlLi5iYTc4ODY5MTU0YzNkMmEzMjRlYzk3 ZGUxMjY3NjljM2U5ZTg3MjIzIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysr IGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTQgQEAKKzIwMTQtMDYtMjYgIEJl bmphbWluIFBvdWxhaW4gIDxiZW5qYW1pbkB3ZWJraXQub3JnPgorCisgICAgICAgIGlPUyA4IGJl dGEgMiBFUzYgJ1NldCcgY2xlYXIoKSBicm9rZW4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTEzNDM0NgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgICoganMvc2NyaXB0LXRlc3RzL3NldC1jbGVhci5qczogQWRk ZWQuCisgICAgICAgICoganMvc2V0LWNsZWFyLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAg ICoganMvc2V0LWNsZWFyLmh0bWw6IEFkZGVkLgorCiAyMDE0LTA2LTI2ICBNYW51ZWwgUmVnbyBD YXNhc25vdmFzICA8cmVnb0BpZ2FsaWEuY29tPgogCiAgICAgICAgIFtDU1MgR3JpZCBMYXlvdXRd IFByb3Blcmx5IHN1cHBvcnQgZm9yIHotaW5kZXggb24gZ3JpZCBpdGVtcwpkaWZmIC0tZ2l0IGEv TGF5b3V0VGVzdHMvanMvc2NyaXB0LXRlc3RzL3NldC1jbGVhci5qcyBiL0xheW91dFRlc3RzL2pz L3NjcmlwdC10ZXN0cy9zZXQtY2xlYXIuanMKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uMTc0NWMyNWZhMjVhZjJlMTNk MmM1ZDM0OTRlMTJlYzIzMDJmOTNiNAotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2pz L3NjcmlwdC10ZXN0cy9zZXQtY2xlYXIuanMKQEAgLTAsMCArMSw1OCBAQAorZGVzY3JpcHRpb24o IlRlc3RzIGJhc2ljIGNvcnJlY3RuZXNzIG9mIEVTIFNldCdzIGNsZWFyKCkgQVBJIik7CisKKy8v IFNldCBjb250YWluaW5nIG9ubHkgU3RyaW5nIHR5cGVzLgordmFyIHN0cmluZ1NldCA9IG5ldyBT ZXQ7CitzdHJpbmdTZXQuYWRkKCdPbGl2ZXInKTsKK3N0cmluZ1NldC5hZGQoJ0JlbmphbWluJyk7 CisKK3N0cmluZ1NldC5jbGVhcigpOworc2hvdWxkQmUoInN0cmluZ1NldC5zaXplIiwgIjAiKTsK K3Nob3VsZEJlKCJzdHJpbmdTZXQudmFsdWVzLmxlbmd0aCIsICIwIik7CitzaG91bGRCZUZhbHNl KCJzdHJpbmdTZXQuaGFzKCdPbGl2ZXInKSIpOworc2hvdWxkQmVGYWxzZSgic3RyaW5nU2V0Lmhh cygnQmVuamFtaW4nKSIpOworCisvLyBTZXQgY29udGFpbmluZyBvbmx5IHByaW1pdGl2ZSB2YWx1 ZXMuCit2YXIgdmFsdWVTZXQgPSBuZXcgU2V0OwordmFsdWVTZXQuYWRkKDApOwordmFsdWVTZXQu YWRkKDEpOworCit2YWx1ZVNldC5jbGVhcigpOworc2hvdWxkQmUoInZhbHVlU2V0LnNpemUiLCAi MCIpOworc2hvdWxkQmUoInZhbHVlU2V0LnZhbHVlcy5sZW5ndGgiLCAiMCIpOworc2hvdWxkQmVG YWxzZSgidmFsdWVTZXQuaGFzKDApIik7CitzaG91bGRCZUZhbHNlKCJ2YWx1ZVNldC5oYXMoMSki KTsKKworLy8gU2V0IGNvbnRhaW5pbmcgb2JqZWN0czsKK3ZhciBvYmplY3RTZXQgPSBuZXcgU2V0 OwordmFyIGFuQXJyYXkgPSBuZXcgQXJyYXk7CitvYmplY3RTZXQuYWRkKGFuQXJyYXkpOwordmFy IGFuT2JqZWN0ID0gbmV3IE9iamVjdDsKK29iamVjdFNldC5hZGQoYW5PYmplY3QpOwordmFyIG90 aGVyT2JqZWN0ID0geyJhIjoxLCAiYiI6Mn07CitvYmplY3RTZXQuYWRkKG90aGVyT2JqZWN0KTsK Kworb2JqZWN0U2V0LmNsZWFyKCk7CitzaG91bGRCZSgib2JqZWN0U2V0LnNpemUiLCAiMCIpOwor c2hvdWxkQmUoIm9iamVjdFNldC52YWx1ZXMubGVuZ3RoIiwgIjAiKTsKK3Nob3VsZEJlRmFsc2Uo Im9iamVjdFNldC5oYXMoYW5BcnJheSkiKTsKK3Nob3VsZEJlRmFsc2UoIm9iamVjdFNldC5oYXMo YW5PYmplY3QpIik7CitzaG91bGRCZUZhbHNlKCJvYmplY3RTZXQuaGFzKG90aGVyT2JqZWN0KSIp OworCisvLyBNaXhlZCB0eXBlcy4KK3ZhciBtaXhlZFR5cGVTZXQgPSBuZXcgU2V0OworbWl4ZWRU eXBlU2V0LmFkZCgwKTsKK21peGVkVHlwZVNldC5hZGQoJ09saXZlcicpOworbWl4ZWRUeXBlU2V0 LmFkZChzdHJpbmdTZXQpOworbWl4ZWRUeXBlU2V0LmFkZCh2YWx1ZVNldCk7CittaXhlZFR5cGVT ZXQuYWRkKG9iamVjdFNldCk7CittaXhlZFR5cGVTZXQuYWRkKGFuT2JqZWN0KTsKKworbWl4ZWRU eXBlU2V0LmNsZWFyKCk7CitzaG91bGRCZSgibWl4ZWRUeXBlU2V0LnNpemUiLCAiMCIpOworc2hv dWxkQmUoIm1peGVkVHlwZVNldC52YWx1ZXMubGVuZ3RoIiwgIjAiKTsKK3Nob3VsZEJlRmFsc2Uo Im1peGVkVHlwZVNldC5oYXMoMCkiKTsKK3Nob3VsZEJlRmFsc2UoIm1peGVkVHlwZVNldC5oYXMo J09saXZlcicpIik7CitzaG91bGRCZUZhbHNlKCJtaXhlZFR5cGVTZXQuaGFzKHN0cmluZ1NldCki KTsKK3Nob3VsZEJlRmFsc2UoIm1peGVkVHlwZVNldC5oYXModmFsdWVTZXQpIik7CitzaG91bGRC ZUZhbHNlKCJtaXhlZFR5cGVTZXQuaGFzKG9iamVjdFNldCkiKTsKK3Nob3VsZEJlRmFsc2UoIm1p eGVkVHlwZVNldC5oYXMoYW5PYmplY3QpIik7CmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9qcy9z ZXQtY2xlYXItZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvanMvc2V0LWNsZWFyLWV4cGVjdGVk LnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwLi42NDUyZDBiNzJlMjM3MTEyYmMyMDhlZjBhOTQ3NjUyYWZlNWE3ZjVl Ci0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvanMvc2V0LWNsZWFyLWV4cGVjdGVkLnR4 dApAQCAtMCwwICsxLDMwIEBACitUZXN0cyBiYXNpYyBjb3JyZWN0bmVzcyBvZiBFUyBTZXQncyBj bGVhcigpIEFQSQorCitPbiBzdWNjZXNzLCB5b3Ugd2lsbCBzZWUgYSBzZXJpZXMgb2YgIlBBU1Mi IG1lc3NhZ2VzLCBmb2xsb3dlZCBieSAiVEVTVCBDT01QTEVURSIuCisKKworUEFTUyBzdHJpbmdT ZXQuc2l6ZSBpcyAwCitQQVNTIHN0cmluZ1NldC52YWx1ZXMubGVuZ3RoIGlzIDAKK1BBU1Mgc3Ry aW5nU2V0LmhhcygnT2xpdmVyJykgaXMgZmFsc2UKK1BBU1Mgc3RyaW5nU2V0LmhhcygnQmVuamFt aW4nKSBpcyBmYWxzZQorUEFTUyB2YWx1ZVNldC5zaXplIGlzIDAKK1BBU1MgdmFsdWVTZXQudmFs dWVzLmxlbmd0aCBpcyAwCitQQVNTIHZhbHVlU2V0LmhhcygwKSBpcyBmYWxzZQorUEFTUyB2YWx1 ZVNldC5oYXMoMSkgaXMgZmFsc2UKK1BBU1Mgb2JqZWN0U2V0LnNpemUgaXMgMAorUEFTUyBvYmpl Y3RTZXQudmFsdWVzLmxlbmd0aCBpcyAwCitQQVNTIG9iamVjdFNldC5oYXMoYW5BcnJheSkgaXMg ZmFsc2UKK1BBU1Mgb2JqZWN0U2V0Lmhhcyhhbk9iamVjdCkgaXMgZmFsc2UKK1BBU1Mgb2JqZWN0 U2V0LmhhcyhvdGhlck9iamVjdCkgaXMgZmFsc2UKK1BBU1MgbWl4ZWRUeXBlU2V0LnNpemUgaXMg MAorUEFTUyBtaXhlZFR5cGVTZXQudmFsdWVzLmxlbmd0aCBpcyAwCitQQVNTIG1peGVkVHlwZVNl dC5oYXMoMCkgaXMgZmFsc2UKK1BBU1MgbWl4ZWRUeXBlU2V0LmhhcygnT2xpdmVyJykgaXMgZmFs c2UKK1BBU1MgbWl4ZWRUeXBlU2V0LmhhcyhzdHJpbmdTZXQpIGlzIGZhbHNlCitQQVNTIG1peGVk VHlwZVNldC5oYXModmFsdWVTZXQpIGlzIGZhbHNlCitQQVNTIG1peGVkVHlwZVNldC5oYXMob2Jq ZWN0U2V0KSBpcyBmYWxzZQorUEFTUyBtaXhlZFR5cGVTZXQuaGFzKGFuT2JqZWN0KSBpcyBmYWxz ZQorUEFTUyBzdWNjZXNzZnVsbHlQYXJzZWQgaXMgdHJ1ZQorCitURVNUIENPTVBMRVRFCisKZGlm ZiAtLWdpdCBhL0xheW91dFRlc3RzL2pzL3NldC1jbGVhci5odG1sIGIvTGF5b3V0VGVzdHMvanMv c2V0LWNsZWFyLmh0bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uNzBlMzA4MjdhZjk0ZWUwNThmOTBhYjdkYTk5MTcx NzI2OGYyNjA4NQotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2pzL3NldC1jbGVhci5o dG1sCkBAIC0wLDAgKzEsMTAgQEAKKzwhRE9DVFlQRSBIVE1MIFBVQkxJQyAiLS8vSUVURi8vRFRE IEhUTUwvL0VOIj4KKzxodG1sPgorPGhlYWQ+Cis8c2NyaXB0IHNyYz0iLi4vcmVzb3VyY2VzL2pz LXRlc3QtcHJlLmpzIj48L3NjcmlwdD4KKzwvaGVhZD4KKzxib2R5PgorPHNjcmlwdCBzcmM9InNj cmlwdC10ZXN0cy9zZXQtY2xlYXIuanMiPjwvc2NyaXB0PgorPHNjcmlwdCBzcmM9Ii4uL3Jlc291 cmNlcy9qcy10ZXN0LXBvc3QuanMiPjwvc2NyaXB0PgorPC9ib2R5PgorPC9odG1sPgo=