<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>155701</bug_id>
          
          <creation_ts>2016-03-20 10:56:44 -0700</creation_ts>
          <short_desc>SmallPtrSet leaks memory in its move assignment operator when !this-&gt;isSmall()</short_desc>
          <delta_ts>2016-03-23 01:21:12 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Saam Barati">saam</reporter>
          <assigned_to name="Saam Barati">saam</assigned_to>
          <cc>benjamin</cc>
    
    <cc>cdumez</cc>
    
    <cc>cmarcelo</cc>
    
    <cc>commit-queue</cc>
    
    <cc>darin</cc>
    
    <cc>fpizlo</cc>
    
    <cc>ggaren</cc>
    
    <cc>gskachkov</cc>
    
    <cc>keith_miller</cc>
    
    <cc>mark.lam</cc>
    
    <cc>msaboff</cc>
    
    <cc>oliver</cc>
    
    <cc>sam</cc>
    
    <cc>sukolsak</cc>
    
    <cc>ysuzuki</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1176598</commentid>
    <comment_count>0</comment_count>
    <who name="Saam Barati">saam</who>
    <bug_when>2016-03-20 10:56:44 -0700</bug_when>
    <thetext>...</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1176602</commentid>
    <comment_count>1</comment_count>
      <attachid>274546</attachid>
    <who name="Saam Barati">saam</who>
    <bug_when>2016-03-20 11:28:12 -0700</bug_when>
    <thetext>Created attachment 274546
patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1176630</commentid>
    <comment_count>2</comment_count>
      <attachid>274546</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2016-03-20 16:35:00 -0700</bug_when>
    <thetext>Comment on attachment 274546
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=274546&amp;action=review

&gt; Source/WTF/wtf/SmallPtrSet.h:60
&gt; +        m_capacity = SmallArraySize;

Normally I prefer to write operator= based on the constructor rather than vice versa. This line of code shows what happens when we don&apos;t do it that way. Might be good to return here later and set that right.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1176680</commentid>
    <comment_count>3</comment_count>
    <who name="Saam Barati">saam</who>
    <bug_when>2016-03-20 22:56:37 -0700</bug_when>
    <thetext>(In reply to comment #2)
&gt; Comment on attachment 274546 [details]
&gt; patch
&gt; 
&gt; View in context:
&gt; https://bugs.webkit.org/attachment.cgi?id=274546&amp;action=review
&gt; 
&gt; &gt; Source/WTF/wtf/SmallPtrSet.h:60
&gt; &gt; +        m_capacity = SmallArraySize;
&gt; 
&gt; Normally I prefer to write operator= based on the constructor rather than
&gt; vice versa. This line of code shows what happens when we don&apos;t do it that
&gt; way. Might be good to return here later and set that right.

Do you mean something like this:

```
SmallPtrSet&amp; operator=(SmallPtrSet&amp;&amp; other)
{
    SmallPtrSet newThis(WTFMove(other));
    swap(newThis);
    return *this;
}
```
?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1177162</commentid>
    <comment_count>4</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2016-03-22 15:27:27 -0700</bug_when>
    <thetext>Yes, something like that. In simple classes there may be further tricks to do it more efficiently.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1177241</commentid>
    <comment_count>5</comment_count>
      <attachid>274717</attachid>
    <who name="Saam Barati">saam</who>
    <bug_when>2016-03-22 17:53:56 -0700</bug_when>
    <thetext>Created attachment 274717
patch

I stole this idea from the B3 code.
We can destruct ourself and then construct the new object
in our place inside the move assignment operator. Maybe this
is too sketchy. But it&apos;s also clever. I&apos;m not 100% sure.

What do you think?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1177272</commentid>
    <comment_count>6</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2016-03-22 21:24:50 -0700</bug_when>
    <thetext>If this generates more efficient code than the traditional swap idiom, I am OK with it.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1177311</commentid>
    <comment_count>7</comment_count>
      <attachid>274717</attachid>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2016-03-23 01:21:06 -0700</bug_when>
    <thetext>Comment on attachment 274717
patch

Clearing flags on attachment: 274717

Committed r198579: &lt;http://trac.webkit.org/changeset/198579&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1177312</commentid>
    <comment_count>8</comment_count>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2016-03-23 01:21:12 -0700</bug_when>
    <thetext>All reviewed patches have been landed.  Closing bug.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>274546</attachid>
            <date>2016-03-20 11:28:12 -0700</date>
            <delta_ts>2016-03-22 17:53:56 -0700</delta_ts>
            <desc>patch</desc>
            <filename>a-backup.diff</filename>
            <type>text/plain</type>
            <size>1259</size>
            <attacher name="Saam Barati">saam</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9XVEYvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XVEYvQ2hh
bmdlTG9nCShyZXZpc2lvbiAxOTg0NzUpCisrKyBTb3VyY2UvV1RGL0NoYW5nZUxvZwkod29ya2lu
ZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBACisyMDE2LTAzLTIwICBTYWFtIGJhcmF0aSAgPHNiYXJh
dGlAYXBwbGUuY29tPgorCisgICAgICAgIFNtYWxsUHRyU2V0IGxlYWtzIG1lbW9yeSBpbiBpdHMg
bW92ZSBhc3NpZ25tZW50IG9wZXJhdG9yIHdoZW4gIXRoaXMtPmlzU21hbGwoKQorICAgICAgICBo
dHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTU1NzAxCisKKyAgICAgICAg
UmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiB3dGYvU21hbGxQdHJTZXQu
aDoKKyAgICAgICAgKFdURjo6U21hbGxQdHJTZXQ6OlNtYWxsUHRyU2V0KToKKyAgICAgICAgKFdU
Rjo6U21hbGxQdHJTZXQ6Om9wZXJhdG9yPSk6CisKIDIwMTYtMDMtMjAgIERhbiBCZXJuc3RlaW4g
IDxtaXR6QGFwcGxlLmNvbT4KIAogICAgICAgICBVcGRhdGUgYnVpbGQgc2V0dGluZ3MKSW5kZXg6
IFNvdXJjZS9XVEYvd3RmL1NtYWxsUHRyU2V0LmgKPT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dURi93
dGYvU21hbGxQdHJTZXQuaAkocmV2aXNpb24gMTk4NDc1KQorKysgU291cmNlL1dURi93dGYvU21h
bGxQdHJTZXQuaAkod29ya2luZyBjb3B5KQpAQCAtNTcsMTEgKzU3LDE2IEBAIHB1YmxpYzogCiAK
ICAgICBTbWFsbFB0clNldChTbWFsbFB0clNldCYmIG90aGVyKQogICAgIHsKKyAgICAgICAgbV9j
YXBhY2l0eSA9IFNtYWxsQXJyYXlTaXplOworICAgICAgICBBU1NFUlQoaXNTbWFsbCgpKTsKICAg
ICAgICAgKnRoaXMgPSBXVEZNb3ZlKG90aGVyKTsKICAgICB9CiAKICAgICBTbWFsbFB0clNldCYg
b3BlcmF0b3I9KFNtYWxsUHRyU2V0JiYgb3RoZXIpCiAgICAgeworICAgICAgICBBU1NFUlQodGhp
cyAhPSAmb3RoZXIpOworICAgICAgICBpZiAoIWlzU21hbGwoKSkKKyAgICAgICAgICAgIGZhc3RG
cmVlKG1fYnVmZmVyKTsKICAgICAgICAgbWVtY3B5KHRoaXMsICZvdGhlciwgc2l6ZW9mKFNtYWxs
UHRyU2V0KSk7CiAgICAgICAgIG90aGVyLmluaXRpYWxpemUoKTsKICAgICAgICAgcmV0dXJuICp0
aGlzOwo=
</data>
<flag name="review"
          id="298978"
          type_id="1"
          status="+"
          setter="darin"
    />
          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>274717</attachid>
            <date>2016-03-22 17:53:56 -0700</date>
            <delta_ts>2016-03-23 01:21:06 -0700</delta_ts>
            <desc>patch</desc>
            <filename>a-backup.diff</filename>
            <type>text/plain</type>
            <size>1307</size>
            <attacher name="Saam Barati">saam</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9XVEYvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XVEYvQ2hh
bmdlTG9nCShyZXZpc2lvbiAxOTg1NjUpCisrKyBTb3VyY2UvV1RGL0NoYW5nZUxvZwkod29ya2lu
ZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBACisyMDE2LTAzLTIyICBTYWFtIEJhcmF0aSAgPHNiYXJh
dGlAYXBwbGUuY29tPgorCisgICAgICAgIFNtYWxsUHRyU2V0IGxlYWtzIG1lbW9yeSBpbiBpdHMg
bW92ZSBhc3NpZ25tZW50IG9wZXJhdG9yIHdoZW4gIXRoaXMtPmlzU21hbGwoKQorICAgICAgICBo
dHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTU1NzAxCisKKyAgICAgICAg
UmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiB3dGYvU21hbGxQdHJTZXQu
aDoKKyAgICAgICAgKFdURjo6U21hbGxQdHJTZXQ6OlNtYWxsUHRyU2V0KToKKyAgICAgICAgKFdU
Rjo6U21hbGxQdHJTZXQ6Om9wZXJhdG9yPSk6CisKIDIwMTYtMDMtMjIgIFBlciBBcm5lIFZvbGxh
biAgPHBlYXZvQG91dGxvb2suY29tPgogCiAgICAgICAgIFtXaW5dIFs2NC1iaXRdIFJlbW92ZSBN
U1ZDIDIwMTMgRk1BMyBCdWcgV29ya2Fyb3VuZApJbmRleDogU291cmNlL1dURi93dGYvU21hbGxQ
dHJTZXQuaAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV1RGL3d0Zi9TbWFsbFB0clNldC5oCShyZXZp
c2lvbiAxOTg1NjUpCisrKyBTb3VyY2UvV1RGL3d0Zi9TbWFsbFB0clNldC5oCSh3b3JraW5nIGNv
cHkpCkBAIC01NywxMyArNTcsMTQgQEAgcHVibGljOiAKIAogICAgIFNtYWxsUHRyU2V0KFNtYWxs
UHRyU2V0JiYgb3RoZXIpCiAgICAgewotICAgICAgICAqdGhpcyA9IFdURk1vdmUob3RoZXIpOwor
ICAgICAgICBtZW1jcHkodGhpcywgJm90aGVyLCBzaXplb2YoU21hbGxQdHJTZXQpKTsKKyAgICAg
ICAgb3RoZXIuaW5pdGlhbGl6ZSgpOwogICAgIH0KIAogICAgIFNtYWxsUHRyU2V0JiBvcGVyYXRv
cj0oU21hbGxQdHJTZXQmJiBvdGhlcikKICAgICB7Ci0gICAgICAgIG1lbWNweSh0aGlzLCAmb3Ro
ZXIsIHNpemVvZihTbWFsbFB0clNldCkpOwotICAgICAgICBvdGhlci5pbml0aWFsaXplKCk7Cisg
ICAgICAgIHRoaXMtPn5TbWFsbFB0clNldCgpOworICAgICAgICBuZXcgKHRoaXMpIFNtYWxsUHRy
U2V0KFdURk1vdmUob3RoZXIpKTsKICAgICAgICAgcmV0dXJuICp0aGlzOwogICAgIH0KIAo=
</data>

          </attachment>
      

    </bug>

</bugzilla>