153546 2016-01-27 09:07:30 -0800 Air::TmpWidth uses a stale pointer into its HashMap after it calls add() 2016-01-27 12:11:21 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build All All RESOLVED FIXED P2 Normal --- 150279 1 fpizlo fpizlo barraclough benjamin ggaren keith_miller mark.lam mhahnenb msaboff oliver saam sam oldest_to_newest 1159294 0 fpizlo 2016-01-27 09:07:30 -0800 Patch forthcoming. 1159295 1 270001 fpizlo 2016-01-27 09:10:39 -0800 Created attachment 270001 the patch 1159332 2 270001 saam 2016-01-27 11:01:13 -0800 Comment on attachment 270001 the patch View in context: https://bugs.webkit.org/attachment.cgi?id=270001&action=review r=me > Source/JavaScriptCore/b3/air/AirTmpWidth.cpp:142 > + // We already ensures that both tmps are added to the width map. That's important I don't think this comment is needed given the above. If you think we need is, "ensures" => "ensure" 1159363 3 fpizlo 2016-01-27 12:11:21 -0800 Landed in http://trac.webkit.org/changeset/195683 270001 2016-01-27 09:10:39 -0800 2016-01-27 11:01:13 -0800 the patch blah.patch text/plain 2516 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTk1NjczKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBA CisyMDE2LTAxLTI3ICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg QWlyOjpUbXBXaWR0aCB1c2VzIGEgc3RhbGUgcG9pbnRlciBpbnRvIGl0cyBIYXNoTWFwIGFmdGVy IGl0IGNhbGxzIGFkZCgpCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn LmNnaT9pZD0xNTM1NDYKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKwor ICAgICAgICAqIGIzL2Fpci9BaXJUbXBXaWR0aC5jcHA6CisgICAgICAgIChKU0M6OkIzOjpBaXI6 OlRtcFdpZHRoOjpyZWNvbXB1dGUpOgorCiAyMDE2LTAxLTI2ICBCZW5qYW1pbiBQb3VsYWluICA8 YmVuamFtaW5Ad2Via2l0Lm9yZz4KIAogICAgICAgICBbSlNDXSBXaGVuIGxvd2VyaW5nIEIzIHRv IEFpciwgcHJlZmVyUmlnaHRGb3JSZXN1bHQoKSBzaG91bGQgcHJlZmVyIHZhbHVlcyBmcm9tIHRo ZSBzYW1lIGJsb2NrCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYjMvYWlyL0FpclRtcFdp ZHRoLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYjMvYWlyL0FpclRt cFdpZHRoLmNwcAkocmV2aXNpb24gMTk1NjcyKQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2Iz L2Fpci9BaXJUbXBXaWR0aC5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTkwLDYgKzkwLDExIEBAIHZv aWQgVG1wV2lkdGg6OnJlY29tcHV0ZShDb2RlJiBjb2RlKQogICAgICAgICBmb3IgKEluc3QmIGlu c3QgOiAqYmxvY2spIHsKICAgICAgICAgICAgIGlmIChpbnN0Lm9wY29kZSA9PSBNb3ZlICYmIGlu c3QuYXJnc1sxXS5pc1RtcCgpKSB7CiAgICAgICAgICAgICAgICAgaWYgKGluc3QuYXJnc1swXS5p c1RtcCgpKSB7CisgICAgICAgICAgICAgICAgICAgIC8vIE1ha2Ugc3VyZSB0aGF0IGJvdGggc2lk ZXMgb2YgdGhlIE1vdmUgaGF2ZSBhIHdpZHRoIGFscmVhZHkgaW5pdGlhbGl6ZWQuIFRoZQorICAg ICAgICAgICAgICAgICAgICAvLyBmaXhwb2ludCBiZWxvdyBhc3N1bWVzIHRoYXQgaXQgbmV2ZXIg aGFzIHRvIGFkZCB0aGluZ3MgdG8gdGhlIEhhc2hNYXAuCisgICAgICAgICAgICAgICAgICAgIG1f d2lkdGguYWRkKGluc3QuYXJnc1swXS50bXAoKSwgV2lkdGhzKEFyZzo6R1ApKTsKKyAgICAgICAg ICAgICAgICAgICAgbV93aWR0aC5hZGQoaW5zdC5hcmdzWzFdLnRtcCgpLCBXaWR0aHMoQXJnOjpH UCkpOworICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgbW92ZXMuYXBw ZW5kKCZpbnN0KTsKICAgICAgICAgICAgICAgICAgICAgY29udGludWU7CiAgICAgICAgICAgICAg ICAgfQpAQCAtMTMzLDkgKzEzOCwxMyBAQCB2b2lkIFRtcFdpZHRoOjpyZWNvbXB1dGUoQ29kZSYg Y29kZSkKICAgICAgICAgICAgIEFTU0VSVChtb3ZlLT5vcGNvZGUgPT0gTW92ZSk7CiAgICAgICAg ICAgICBBU1NFUlQobW92ZS0+YXJnc1swXS5pc1RtcCgpKTsKICAgICAgICAgICAgIEFTU0VSVCht b3ZlLT5hcmdzWzFdLmlzVG1wKCkpOwotICAgICAgICAgICAgCi0gICAgICAgICAgICBXaWR0aHMm IHNyY1dpZHRocyA9IG1fd2lkdGguYWRkKG1vdmUtPmFyZ3NbMF0udG1wKCksIFdpZHRocyhBcmc6 OkdQKSkuaXRlcmF0b3ItPnZhbHVlOwotICAgICAgICAgICAgV2lkdGhzJiBkc3RXaWR0aHMgPSBt X3dpZHRoLmFkZChtb3ZlLT5hcmdzWzFdLnRtcCgpLCBXaWR0aHMoQXJnOjpHUCkpLml0ZXJhdG9y LT52YWx1ZTsKKworICAgICAgICAgICAgLy8gV2UgYWxyZWFkeSBlbnN1cmVzIHRoYXQgYm90aCB0 bXBzIGFyZSBhZGRlZCB0byB0aGUgd2lkdGggbWFwLiBUaGF0J3MgaW1wb3J0YW50CisgICAgICAg ICAgICAvLyBiZWNhdXNlIHlvdSBjYW5ub3QgYWRkIGJvdGggdG1wcyBoZXJlIHdoaWxlIHNpbXVs dGFuZW91c2x5IGdldHRpbmcgYSByZWZlcmVuY2UgdG8KKyAgICAgICAgICAgIC8vIHRoZWlyIHZh bHVlcywgc2luY2UgdGhlIHNlY29uZCBhZGQgd291bGQgaW52YWxpZGF0ZSB0aGUgcmVmZXJlbmNl IHJldHVybmVkIGJ5IHRoZQorICAgICAgICAgICAgLy8gZmlyc3Qgb25lLgorICAgICAgICAgICAg V2lkdGhzJiBzcmNXaWR0aHMgPSBtX3dpZHRoLmZpbmQobW92ZS0+YXJnc1swXS50bXAoKSktPnZh bHVlOworICAgICAgICAgICAgV2lkdGhzJiBkc3RXaWR0aHMgPSBtX3dpZHRoLmZpbmQobW92ZS0+ YXJnc1sxXS50bXAoKSktPnZhbHVlOwogCiAgICAgICAgICAgICAvLyBMZWdlbmQ6CiAgICAgICAg ICAgICAvLwo=