145421 2015-05-27 16:29:23 -0700 LazyNode comparison can return incorrect results when comparing an empty value 2015-05-28 12:12:06 -0700 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 basile_clement basile_clement darin fpizlo ggaren oldest_to_newest 1097763 0 basile_clement 2015-05-27 16:29:23 -0700 LazyNode comparison can return incorrect results when comparing an empty value 1097765 1 253813 basile_clement 2015-05-27 16:36:32 -0700 Created attachment 253813 Patch 1097775 2 253813 ggaren 2015-05-27 16:44:46 -0700 Comment on attachment 253813 Patch r=me 1097777 3 basile_clement 2015-05-27 16:47:55 -0700 Committed r184927: <http://trac.webkit.org/changeset/184927> 1097919 4 darin 2015-05-28 11:49:43 -0700 Did this bug have a symptom? Can we make a regression test? 1097924 5 basile_clement 2015-05-28 12:12:06 -0700 (In reply to comment #4) > Did this bug have a symptom? Can we make a regression test? I don't think there is a code path that can trigger this bug in ToT. LazyNode has been introduced recently (http://trac.webkit.org/changeset/184776), and as far as I know, the only place where we are comparing them is when comparing the indexes of HeapLocations, and then only after we ensured the kind/heap/base are equal. As the heap + kind of a HeapLocation determine whether is has an index or not, the comparison of LazyNodes won't be reached in the case where only one is non-null. 253813 2015-05-27 16:36:32 -0700 2015-05-27 16:44:46 -0700 Patch bug-145421-20150527163620.patch text/plain 2011 basile_clement U3VidmVyc2lvbiBSZXZpc2lvbjogMTg0OTI1CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCA5 MDMwMjU4MTViYzAxM2ZlMTdlMTZiYWJhYzVkYWY3Njk4NjQ3ODE5Li43MGQ2NWM1ODViMDUwMmNj NWZiOWRkNjc1NGUxOWVlOTI0MTcxYjgxIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwyMyBAQAorMjAxNS0wNS0yNyAgQmFzaWxlIENsZW1lbnQgIDxiYXNpbGVfY2xlbWVudEBh cHBsZS5jb20+CisKKyAgICAgICAgTGF6eU5vZGUgY29tcGFyaXNvbiBjYW4gcmV0dXJuIGluY29y cmVjdCByZXN1bHRzIHdoZW4gY29tcGFyaW5nIGFuIGVtcHR5IHZhbHVlCisgICAgICAgIGh0dHBz Oi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNDU0MjEKKworICAgICAgICBSZXZp ZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBXaGVuIGNvbXBhcmluZyBhIExhenlO b2RlIHRvIGFub3RoZXIsIHdlIGNvbXBhcmUgdGhlIHZhbHVlIHBvaW50ZXJzIGlmCisgICAgICAg IHdlIGhhdmUgb25lLCBhbmQgb3RoZXJ3aXNlIGNvbXBhcmUgdGhlIG5vZGVzLgorICAgICAgICBX ZSBzaG91bGQgYmUgY29tcGFyaW5nIHZhbHVlIHBvaW50ZXJzIGlmIHRoZSBvdGhlciBMYXp5Tm9k ZSBoYXMgb25lIGFzCisgICAgICAgIHdlbGwsIG90aGVyd2lzZSB3ZSByaXNrIGFuIGluY29oZXJl bmN5IHdoZW4gd2UgYXJlIGEgZW1wdHkgTGF6eU5vZGUKKyAgICAgICAgYmVpbmcgY29tcGFyZWQg dG8gYSBGcm96ZW5WYWx1ZSB3aXRob3V0IG5vZGUuCisKKyAgICAgICAgTm90ZSB0aGF0IHRoaXMg aXMgbm90IGEgcHJvYmxlbSBpbiBhbnkgb3RoZXIgY2FzZSBiZWNhdXNlIGlmIHdlIGRvbid0Cisg ICAgICAgIGhhdmUgYSBGcm96ZW5WYWx1ZSBhbmQgd2UgYXJlIG5vdCBhbiBlbXB0eSBMYXp5Tm9k ZSwgd2UgYXJlIGEKKyAgICAgICAgbm9uLWNvbnN0YW50IG5vZGUsIGFuZCBjb21wYXJpbmcgdGhl IG5vZGUgcG9pbnRlcnMgaXMgY29ycmVjdC4KKworICAgICAgICAqIGRmZy9ERkdMYXp5Tm9kZS5o OgorICAgICAgICAoSlNDOjpERkc6OkxhenlOb2RlOjpvcGVyYXRvcj09KToKKwogMjAxNS0wNS0y NiAgRmlsaXAgUGl6bG8gIDxmcGl6bG9AYXBwbGUuY29tPgogCiAgICAgICAgIEpJVC1nZW5lcmF0 ZWQgc3RvcmUgYmFycmllciBjb2RlIHNob3VsZCBhc3N1bWUgdGhlIGJ1ZmZlciBwb2ludGVyIGFu ZCBjYXBhY2l0eSB0byBiZSBjb21waWxlLXRpbWUgY29uc3RhbnRzCmRpZmYgLS1naXQgYS9Tb3Vy Y2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0xhenlOb2RlLmggYi9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvZGZnL0RGR0xhenlOb2RlLmgKaW5kZXggMTI1NzFmN2FiYWNiMGZlZTlmMjY3YjNkZjZlYjA2 ZmNlOTdjNjk1Yi4uY2M3MTAyYmIwNWIxZWU4YmIwZGYwYTM0YTkyMjhmZTEzN2MxZWIwNiAxMDA2 NDQKLS0tIGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdMYXp5Tm9kZS5oCisrKyBiL1Nv dXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHTGF6eU5vZGUuaApAQCAtMzQsOCArMzQsNiBAQAog CiBuYW1lc3BhY2UgSlNDIHsgbmFtZXNwYWNlIERGRyB7CiAKLQotCiBjbGFzcyBMYXp5Tm9kZSB7 CiBwdWJsaWM6CiAgICAgc3RhdGljIGNvbnN0IHNpemVfdCBqc0NvbnN0YW50VGFnID0gMDsKQEAg LTExOSw3ICsxMTcsNyBAQCBwdWJsaWM6CiAKICAgICBib29sIG9wZXJhdG9yPT0oY29uc3QgTGF6 eU5vZGUmIG90aGVyKSBjb25zdAogICAgIHsKLSAgICAgICAgaWYgKGFzVmFsdWUoKSkKKyAgICAg ICAgaWYgKGFzVmFsdWUoKSB8fCBvdGhlci5hc1ZhbHVlKCkpCiAgICAgICAgICAgICByZXR1cm4g bV92YWx1ZSA9PSBvdGhlci5tX3ZhbHVlOwogICAgICAgICByZXR1cm4gbV9ub2RlID09IG90aGVy Lm1fbm9kZTsKICAgICB9Cg==