156444 CVE-2016-4624 2016-04-09 13:48:51 -0700 Allocation sinking SSA Defs are allowed to have replacements 2016-07-19 17:27:23 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 saam saam benjamin bfulgham fpizlo ggaren gskachkov keith_miller mark.lam msaboff oliver sukolsak ysuzuki oldest_to_newest 1182500 0 saam 2016-04-09 13:48:51 -0700 ... 1182503 1 276095 saam 2016-04-09 14:02:52 -0700 Created attachment 276095 patch 1182512 2 fpizlo 2016-04-09 16:07:15 -0700 R=me. For some reason it's not letting me set the R+ flag 1182519 3 saam 2016-04-09 17:26:59 -0700 Thanks for the review. landed in: http://trac.webkit.org/changeset/199277 276095 2016-04-09 14:02:52 -0700 2016-04-09 17:33:05 -0700 patch a-backup.diff text/plain 3528 saam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTk5Mjc1KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDQ4IEBA CisyMDE2LTA0LTA5ICBTYWFtIGJhcmF0aSAgPHNiYXJhdGlAYXBwbGUuY29tPgorCisgICAgICAg IEFsbG9jYXRpb24gc2lua2luZyBTU0EgRGVmcyBhcmUgYWxsb3dlZCB0byBoYXZlIHJlcGxhY2Vt ZW50cworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTU2 NDQ0CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQ29u c2lkZXIgdGhlIGZvbGxvd2luZyBwcm9ncmFtIGFuZCB0aGUgYW5ub3RhdGlvbnMgdGhhdCBleHBs YWluIHdoeQorICAgICAgICB0aGUgU1NBIGRlZnMgd2UgY3JlYXRlIGluIGFsbG9jYXRpb24gc2lu a2luZyBjYW4gaGF2ZSByZXBsYWNlbWVudHMuCisKKyAgICAgICAgZnVuY3Rpb24gZm9vKGExKSB7 CisgICAgICAgICAgICBsZXQgbzEgPSB7eDogMjAsIHk6IDUwfTsKKyAgICAgICAgICAgIGxldCBv MiA9IHt5OiA0MCwgbzE6IG8xfTsKKyAgICAgICAgICAgIGxldCBvMyA9IHt9OworICAgICAgICAK KyAgICAgICAgICAgIC8vIFdlJ3JlIERlZmluZyBhIG5ldyB2YXJpYWJsZSBoZXJlLCBjYWxsIGl0 IG8zX2ZpZWxkLgorICAgICAgICAgICAgLy8gbzNfZmllbGQgaXMgZGVmaW5nIHRoZSB2YWx1ZSB0 aGF0IGlzIHRoZSByZXN1bHQgb2YgCisgICAgICAgICAgICAvLyBhIEdldEJ5T2Zmc2V0IHRoYXQg Z2V0cyBlbGltaW5hdGVkIHRocm91Z2ggYWxsb2NhdGlvbiBzaW5raW5nLgorICAgICAgICAgICAg bzMuZmllbGQgPSBvMS55OworICAgICAgICAKKyAgICAgICAgICAgIGRvbnRDU0UoKTsKKyAgICAg ICAgCisgICAgICAgICAgICAvLyBUaGlzIGNvbnRyb2wgZmxvdyBpcyBoZXJlIHRvIG5vdCBhbGxv dyB0aGUgcGhhc2UgdG8gY29uc3VsdAorICAgICAgICAgICAgLy8gaXRzIGxvY2FsIFNTQSBtYXBw aW5nICh3aGljaCBwcm9wZXJseSBoYW5kbGVzIHJlcGxhY2VtZW50cykKKyAgICAgICAgICAgIC8v IGZvciB0aGUgdmFsdWUgb2YgbzNfZmllbGQuCisgICAgICAgICAgICBpZiAoYTEpIHsKKyAgICAg ICAgICAgICAgICBhMSA9IHRydWU7IAorICAgICAgICAgICAgfSBlbHNlIHsKKyAgICAgICAgICAg ICAgICBhMSA9IGZhbHNlOworICAgICAgICAgICAgfQorICAgICAgICAKKyAgICAgICAgICAgIC8v IEhlcmUsIHdlIGFzayBmb3IgdGhlIHJlYWNoaW5nIGRlZiBvZiBvM19maWVsZCwgYW5kIGFzc2Vy dAorICAgICAgICAgICAgLy8gaXQgZG9lc24ndCBoYXZlIGEgcmVwbGFjZW1lbnQuIEl0IGRvZXMg aGF2ZSBhIHJlcGxhY2VtZW50CisgICAgICAgICAgICAvLyB0aG91Z2guIFRoZSBvcmlnaW5hbCBE ZWYgd2FzIHRoZSBHZXRCeU9mZnNldC4gV2UgcmVwbGFjZWQKKyAgICAgICAgICAgIC8vIHRoYXQg R2V0QnlPZmZzZXQgd2l0aCB0aGUgdmFsdWUgb2YgdGhlIG8xX3kgdmFyaWFibGUuCisgICAgICAg ICAgICBsZXQgdmFsdWUgPSBvMy5maWVsZDsKKyAgICAgICAgICAgIGFzc2VydCh2YWx1ZSA9PT0g NTApOworICAgICAgICB9CisKKyAgICAgICAgKiBkZmcvREZHT2JqZWN0QWxsb2NhdGlvblNpbmtp bmdQaGFzZS5jcHA6CisgICAgICAgICogdGVzdHMvc3RyZXNzL2FsbG9jYXRpb24tc2lua2luZy1k ZWZzLW1heS1oYXZlLXJlcGxhY2VtZW50cy5qczogQWRkZWQuCisgICAgICAgIChkb250Q1NFKToK KyAgICAgICAgKGFzc2VydCk6CisgICAgICAgIChmb28pOgorCiAyMDE2LTA0LTA5ICBGaWxpcCBQ aXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CiAKICAgICAgICAgRGVidWcgSlNDIHRlc3QgZmFpbHVy ZTogc3RyZXNzL211bHRpLXB1dC1ieS1vZmZzZXQtcmVhbGxvY2F0aW9uLWJ1dHRlcmZseS1jc2Uu anMuZnRsLW5vLWNqaXQtc21hbGwtcG9vbApJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2Rm Zy9ERkdPYmplY3RBbGxvY2F0aW9uU2lua2luZ1BoYXNlLmNwcAo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3Vy Y2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR09iamVjdEFsbG9jYXRpb25TaW5raW5nUGhhc2UuY3Bw CShyZXZpc2lvbiAxOTkxODEpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR09iamVj dEFsbG9jYXRpb25TaW5raW5nUGhhc2UuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xODYyLDcgKzE4 NjIsOCBAQCBwcml2YXRlOgogICAgICAgICBBU1NFUlQoZGVmLT52YWx1ZSgpKTsKIAogICAgICAg ICBOb2RlKiByZXN1bHQgPSBkZWYtPnZhbHVlKCk7Ci0KKyAgICAgICAgaWYgKHJlc3VsdC0+cmVw bGFjZW1lbnQoKSkKKyAgICAgICAgICAgIHJlc3VsdCA9IHJlc3VsdC0+cmVwbGFjZW1lbnQoKTsK ICAgICAgICAgQVNTRVJUKCFyZXN1bHQtPnJlcGxhY2VtZW50KCkpOwogCiAgICAgICAgIG1fbG9j YWxNYXBwaW5nLmFkZChsb2NhdGlvbiwgcmVzdWx0KTsKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0 Q29yZS90ZXN0cy9zdHJlc3MvYWxsb2NhdGlvbi1zaW5raW5nLWRlZnMtbWF5LWhhdmUtcmVwbGFj ZW1lbnRzLmpzCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS90ZXN0cy9zdHJl c3MvYWxsb2NhdGlvbi1zaW5raW5nLWRlZnMtbWF5LWhhdmUtcmVwbGFjZW1lbnRzLmpzCShyZXZp c2lvbiAwKQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL3Rlc3RzL3N0cmVzcy9hbGxvY2F0aW9u LXNpbmtpbmctZGVmcy1tYXktaGF2ZS1yZXBsYWNlbWVudHMuanMJKHdvcmtpbmcgY29weSkKQEAg LTAsMCArMSwzMSBAQAorZnVuY3Rpb24gZG9udENTRSgpIHsgfQorbm9JbmxpbmUoZG9udENTRSk7 CisKK2Z1bmN0aW9uIGFzc2VydChiKSB7CisgICAgaWYgKCFiKQorICAgICAgICB0aHJvdyBuZXcg RXJyb3IoIkJhZCBhc3NlcnRpb24iKTsKK30KK25vSW5saW5lKGFzc2VydCk7CisKK2Z1bmN0aW9u IGZvbyhhMSkgeworICAgIGxldCBvMSA9IHt4OiAyMCwgeTogNTB9OworICAgIGxldCBvMiA9IHt5 OiA0MCwgbzE6IG8xfTsKKyAgICBsZXQgbzMgPSB7fTsKKworICAgIG8zLmZpZWxkID0gbzEueTsK KworICAgIGRvbnRDU0UoKTsKKworICAgIGlmIChhMSkgeworICAgICAgICBhMSA9IHRydWU7IAor ICAgIH0gZWxzZSB7CisgICAgICAgIGExID0gZmFsc2U7CisgICAgfQorCisgICAgbGV0IHZhbHVl ID0gbzMuZmllbGQ7CisgICAgYXNzZXJ0KHZhbHVlID09PSA1MCk7Cit9Citub0lubGluZShmb28p OworCitmb3IgKGxldCBpID0gMDsgaSA8IDEwMDAwMDsgaSsrKQorICAgIGZvbyhpKTsK