169055 2017-03-01 14:00:28 -0800 REGRESSION(r213222) Possible use after free when setting some string based Options 2017-03-01 22:31:33 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=169057 P2 Normal --- 169029 1 msaboff msaboff commit-queue keith_miller mark.lam saam oldest_to_newest 1282435 0 msaboff 2017-03-01 14:00:28 -0800 Change set r213222 could introduce use after free when setting certain options. 1282442 1 303116 msaboff 2017-03-01 14:08:27 -0800 Created attachment 303116 Patch 1282444 2 303116 mark.lam 2017-03-01 14:14:43 -0800 Comment on attachment 303116 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=303116&action=review r=me > Source/JavaScriptCore/runtime/Options.cpp:110 > + // FIXME: This could leak if this option is set more than once. > + // Given that Options are typically used for testing, this isn't considered to be a problem. Please add a bugzilla URL for this FIXME. > Source/JavaScriptCore/runtime/Options.cpp:253 > + // FIXME: This could leak if this particular option is set more than once. > + // Given that these options are used for testing, this isn't considered to be problem. Ditto: please add a bugzilla URL. 1282449 3 msaboff 2017-03-01 14:27:18 -0800 Committed r213242: <http://trac.webkit.org/changeset/213242> 303116 2017-03-01 14:08:27 -0800 2017-03-01 14:14:43 -0800 Patch 169055.patch text/plain 2388 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjEzMjQxKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBA CisyMDE3LTAzLTAxICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKKyAgICAgICAgaHR0cHM6Ly9idWdz LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE2OTA1NQorCisgICAgICAgIFJldmlld2VkIGJ5 IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIE1hZGUgbG9jYWwgY29waWVzIG9mIG9wdGlvbnMg c3RyaW5ncyBmb3IgT3B0aW9uUmFuZ2UgYW5kIHN0cmluZyB0eXBlZCBvcHRpb25zLgorCisgICAg ICAgICogcnVudGltZS9PcHRpb25zLmNwcDoKKyAgICAgICAgKEpTQzo6cGFyc2UpOgorICAgICAg ICAoSlNDOjpPcHRpb25SYW5nZTo6aW5pdCk6CisKIDIwMTctMDMtMDEgIE1hcmsgTGFtICA8bWFy ay5sYW1AYXBwbGUuY29tPgogCiAgICAgICAgIFtSZS1sYW5kaW5nXSBDaGFuZ2UgSlNMb2NrIHRv IHN0YXNoIFBsYXRmb3JtVGhyZWFkIGluc3RlYWQgb2Ygc3RkOjp0aHJlYWQ6OmlkLgpJbmRleDog U291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvT3B0aW9ucy5jcHAKPT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0g U291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvT3B0aW9ucy5jcHAJKHJldmlzaW9uIDIxMzIz OSkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL09wdGlvbnMuY3BwCSh3b3JraW5n IGNvcHkpCkBAIC0xMDEsOSArMTAxLDE0IEBAIHN0YXRpYyBib29sIHBhcnNlKGNvbnN0IGNoYXIq IHN0cmluZywgT3AKIAogc3RhdGljIGJvb2wgcGFyc2UoY29uc3QgY2hhciogc3RyaW5nLCBjb25z dCBjaGFyKiYgdmFsdWUpCiB7Ci0gICAgaWYgKCFzdHJsZW4oc3RyaW5nKSkKLSAgICAgICAgc3Ry aW5nID0gbnVsbHB0cjsKLSAgICB2YWx1ZSA9IHN0cmluZzsKKyAgICBpZiAoIXN0cmxlbihzdHJp bmcpKSB7CisgICAgICAgIHZhbHVlID0gbnVsbHB0cjsKKyAgICAgICAgcmV0dXJuIHRydWU7Cisg ICAgfQorCisgICAgLy8gRklYTUU6IFRoaXMgY291bGQgbGVhayBpZiB0aGlzIG9wdGlvbiBpcyBz ZXQgbW9yZSB0aGFuIG9uY2UuCisgICAgLy8gR2l2ZW4gdGhhdCBPcHRpb25zIGFyZSB0eXBpY2Fs bHkgdXNlZCBmb3IgdGVzdGluZywgdGhpcyBpc24ndCBjb25zaWRlcmVkIHRvIGJlIGEgcHJvYmxl bS4KKyAgICB2YWx1ZSA9IFdURjo6ZmFzdFN0ckR1cChzdHJpbmcpOwogICAgIHJldHVybiB0cnVl OwogfQogCkBAIC0yMjIsMTQgKzIyNywxNCBAQCBib29sIE9wdGlvblJhbmdlOjppbml0KGNvbnN0 IGNoYXIqIHJhbmdlCiAgICAgICAgIHJldHVybiB0cnVlOwogICAgIH0KICAgICAKLSAgICBtX3Jh bmdlU3RyaW5nID0gcmFuZ2VTdHJpbmc7CisgICAgY29uc3QgY2hhciogcCA9IHJhbmdlU3RyaW5n OwogCi0gICAgaWYgKCpyYW5nZVN0cmluZyA9PSAnIScpIHsKKyAgICBpZiAoKnAgPT0gJyEnKSB7 CiAgICAgICAgIGludmVydCA9IHRydWU7Ci0gICAgICAgIHJhbmdlU3RyaW5nKys7CisgICAgICAg IHArKzsKICAgICB9CiAKLSAgICBpbnQgc2NhblJlc3VsdCA9IHNzY2FuZihyYW5nZVN0cmluZywg IiAldToldSIsICZtX2xvd0xpbWl0LCAmbV9oaWdoTGltaXQpOworICAgIGludCBzY2FuUmVzdWx0 ID0gc3NjYW5mKHAsICIgJXU6JXUiLCAmbV9sb3dMaW1pdCwgJm1faGlnaExpbWl0KTsKIAogICAg IGlmICghc2NhblJlc3VsdCB8fCBzY2FuUmVzdWx0ID09IEVPRikgewogICAgICAgICBtX3N0YXRl ID0gSW5pdEVycm9yOwpAQCAtMjQ0LDYgKzI0OSw5IEBAIGJvb2wgT3B0aW9uUmFuZ2U6OmluaXQo Y29uc3QgY2hhciogcmFuZ2UKICAgICAgICAgcmV0dXJuIGZhbHNlOwogICAgIH0KIAorICAgIC8v IEZJWE1FOiBUaGlzIGNvdWxkIGxlYWsgaWYgdGhpcyBwYXJ0aWN1bGFyIG9wdGlvbiBpcyBzZXQg bW9yZSB0aGFuIG9uY2UuCisgICAgLy8gR2l2ZW4gdGhhdCB0aGVzZSBvcHRpb25zIGFyZSB1c2Vk IGZvciB0ZXN0aW5nLCB0aGlzIGlzbid0IGNvbnNpZGVyZWQgdG8gYmUgcHJvYmxlbS4KKyAgICBt X3JhbmdlU3RyaW5nID0gV1RGOjpmYXN0U3RyRHVwKHJhbmdlU3RyaW5nKTsKICAgICBtX3N0YXRl ID0gaW52ZXJ0ID8gSW52ZXJ0ZWQgOiBOb3JtYWw7CiAKICAgICByZXR1cm4gdHJ1ZTsK