<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>201953</bug_id>
          
          <creation_ts>2019-09-18 16:22:46 -0700</creation_ts>
          <short_desc>TOCTOU bug in havingABadTime related assertion in DFGSpeculativeJIT</short_desc>
          <delta_ts>2019-09-18 16:43:12 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Saam Barati">saam</reporter>
          <assigned_to name="Saam Barati">saam</assigned_to>
          <cc>benjamin</cc>
    
    <cc>fpizlo</cc>
    
    <cc>ggaren</cc>
    
    <cc>gskachkov</cc>
    
    <cc>guijemont</cc>
    
    <cc>keith_miller</cc>
    
    <cc>mark.lam</cc>
    
    <cc>msaboff</cc>
    
    <cc>rmorisset</cc>
    
    <cc>ticaiolima</cc>
    
    <cc>tzagallo</cc>
    
    <cc>webkit-bug-importer</cc>
    
    <cc>ysuzuki</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1572141</commentid>
    <comment_count>0</comment_count>
    <who name="Saam Barati">saam</who>
    <bug_when>2019-09-18 16:22:46 -0700</bug_when>
    <thetext>...</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1572142</commentid>
    <comment_count>1</comment_count>
    <who name="Saam Barati">saam</who>
    <bug_when>2019-09-18 16:23:14 -0700</bug_when>
    <thetext>&lt;rdar://problem/53803524&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1572146</commentid>
    <comment_count>2</comment_count>
      <attachid>379084</attachid>
    <who name="Saam Barati">saam</who>
    <bug_when>2019-09-18 16:33:23 -0700</bug_when>
    <thetext>Created attachment 379084
patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1572147</commentid>
    <comment_count>3</comment_count>
      <attachid>379084</attachid>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2019-09-18 16:35:22 -0700</bug_when>
    <thetext>Comment on attachment 379084
patch

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1572148</commentid>
    <comment_count>4</comment_count>
      <attachid>379084</attachid>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2019-09-18 16:35:34 -0700</bug_when>
    <thetext>Comment on attachment 379084
patch

r=me too</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1572151</commentid>
    <comment_count>5</comment_count>
    <who name="Saam Barati">saam</who>
    <bug_when>2019-09-18 16:43:12 -0700</bug_when>
    <thetext>Committed r250065: &lt;https://trac.webkit.org/changeset/250065&gt;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>379084</attachid>
            <date>2019-09-18 16:33:23 -0700</date>
            <delta_ts>2019-09-18 16:35:22 -0700</delta_ts>
            <desc>patch</desc>
            <filename>b-backup.diff</filename>
            <type>text/plain</type>
            <size>4236</size>
            <attacher name="Saam Barati">saam</attacher>
            
              <data encoding="base64">SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n
CShyZXZpc2lvbiAyNTAwNjMpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA
QCAtMSwzICsxLDE0IEBACisyMDE5LTA5LTE4ICBTYWFtIEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUu
Y29tPgorCisgICAgICAgIFRPQ1RPVSBidWcgaW4gaGF2aW5nQUJhZFRpbWUgcmVsYXRlZCBhc3Nl
cnRpb24gaW4gREZHU3BlY3VsYXRpdmVKSVQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5v
cmcvc2hvd19idWcuY2dpP2lkPTIwMTk1MworICAgICAgICA8cmRhcjovL3Byb2JsZW0vNTM4MDM1
MjQ+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBz
dHJlc3MvdG9jdG91LWhhdmluZy1hLWJhZC10aW1lLW5ldy1hcnJheS5qczogQWRkZWQuCisgICAg
ICAgIChsZXQuY29kZSk6CisKIDIwMTktMDktMTggIFNhYW0gQmFyYXRpICA8c2JhcmF0aUBhcHBs
ZS5jb20+CiAKICAgICAgICAgUGhhbnRvbSBpbnNlcnRpb24gcGhhc2UgbWF5IGRpc2FncmVlIHdp
dGggYXJndW1lbnRzIGZvcndhcmRpbmcgYWJvdXQgbGl2ZSByYW5nZXMKSW5kZXg6IEpTVGVzdHMv
c3RyZXNzL3RvY3RvdS1oYXZpbmctYS1iYWQtdGltZS1uZXctYXJyYXkuanMKPT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot
LS0gSlNUZXN0cy9zdHJlc3MvdG9jdG91LWhhdmluZy1hLWJhZC10aW1lLW5ldy1hcnJheS5qcwko
bm9uZXhpc3RlbnQpCisrKyBKU1Rlc3RzL3N0cmVzcy90b2N0b3UtaGF2aW5nLWEtYmFkLXRpbWUt
bmV3LWFycmF5LmpzCSh3b3JraW5nIGNvcHkpCkBAIC0wLDAgKzEsMTYgQEAKK2xldCBjb2RlID0g
YAorICAgIGZ1bmN0aW9uIGZvbygpIHsKKyAgICAgIHJldHVybiBbRGF0ZS5wcm90b3R5cGVdOwor
ICAgIH0KKworICAgIGZvciAobGV0IGkgPSAwOyBpIDwgNTA7ICsraSkgeworICAgICAgZm9vKCk7
CisgICAgfQorCisgICAgbGV0IFtwcm90b10gPSBmb28oKTsKKyAgICBPYmplY3QuZGVmaW5lUHJv
cGVydHkocHJvdG8sICcwJywge30pOworYDsKKworZm9yIChsZXQgaSA9IDA7IGkgPCA1MDAwOyBp
KyspIHsKKyAgICBydW5TdHJpbmcoY29kZSk7Cit9CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENv
cmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VM
b2cJKHJldmlzaW9uIDI1MDA1OCkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cJ
KHdvcmtpbmcgY29weSkKQEAgLTEsMyArMSwyOCBAQAorMjAxOS0wOS0xOCAgU2FhbSBCYXJhdGkg
IDxzYmFyYXRpQGFwcGxlLmNvbT4KKworICAgICAgICBUT0NUT1UgYnVnIGluIGhhdmluZ0FCYWRU
aW1lIHJlbGF0ZWQgYXNzZXJ0aW9uIGluIERGR1NwZWN1bGF0aXZlSklUCisgICAgICAgIGh0dHBz
Oi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMDE5NTMKKyAgICAgICAgPHJkYXI6
Ly9wcm9ibGVtLzUzODAzNTI0PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEp
LgorCisgICAgICAgIFdlIGhhZCBjb2RlIGluIERGR1NwZWN1bGF0aXZlSklUIGxpa2U6CisgICAg
ICAgIAorICAgICAgICBpZiAoIWdsb2JhbE9iamVjdC0+aXNIYXZpbmdBQmFkVGltZSgpKSB7Cisg
ICAgICAgICAgICA8LS0gaGVyZSAtLT4KKyAgICAgICAgICAgIFN0cnVjdHVyZSogcyA9IGdsb2Jh
bE9iamVjdC0+YXJyYXlTdHJ1Y3R1cmVGb3JJbmRleGluZ1R5cGVEdXJpbmdBbGxvY2F0aW9uKG5v
ZGUtPmluZGV4aW5nVHlwZSgpKSk7CisgICAgICAgICAgICBhc3NlcnQgJ3MnIGhhcyBleHBlY3Rl
ZCBpbmRleGluZyB0eXBlCisgICAgICAgIH0KKyAgICAgICAgCisgICAgICAgIFRoZSBwcm9ibGVt
IGlzLCB3ZSBtYXkgaGF2ZSBhIGJhZCB0aW1lIGJlZm9yZSB3ZSBhY3R1YWxseSBsb2FkIHRoZSBz
dHJ1Y3R1cmUKKyAgICAgICAgaW5zaWRlIHRoZSBpZi4gV2UgbWF5IGhhdmUgYSBiYWQgdGltZSB3
aGlsZSB3ZSdyZSBhdCB0aGUgIjwtLSBoZXJlIC0tPiIgaW4gdGhlCisgICAgICAgIGFib3ZlIHBy
b2dyYW0uIFRoZSBmaXggaXMgdG8gZmlyc3QgbG9hZCB0aGUgc3RydWN0dXJlLCB0aGVuIGNoZWNr
IGlmIHdlJ3JlCisgICAgICAgIGhhdmluZyBhIGJhZCB0aW1lLiBJZiB3ZSdyZSBzdGlsbCBub3Qg
aGF2aW5nIGEgYmFkIHRpbWUsIGl0J3MgdmFsaWQgdG8gYXNzZXJ0CisgICAgICAgIHRoaW5ncyBh
Ym91dCB0aGUgc3RydWN0dXJlLgorCisgICAgICAgICogZGZnL0RGR1NwZWN1bGF0aXZlSklULmNw
cDoKKyAgICAgICAgKEpTQzo6REZHOjpTcGVjdWxhdGl2ZUpJVDo6Y29tcGlsZU5ld0FycmF5KToK
KwogMjAxOS0wOS0xOCAgU2FhbSBCYXJhdGkgIDxzYmFyYXRpQGFwcGxlLmNvbT4KIAogICAgICAg
ICBQaGFudG9tIGluc2VydGlvbiBwaGFzZSBtYXkgZGlzYWdyZWUgd2l0aCBhcmd1bWVudHMgZm9y
d2FyZGluZyBhYm91dCBsaXZlIHJhbmdlcwpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2Rm
Zy9ERkdTcGVjdWxhdGl2ZUpJVC5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRD
b3JlL2RmZy9ERkdTcGVjdWxhdGl2ZUpJVC5jcHAJKHJldmlzaW9uIDI1MDA1NikKKysrIFNvdXJj
ZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHU3BlY3VsYXRpdmVKSVQuY3BwCSh3b3JraW5nIGNvcHkp
CkBAIC03OTU0LDggKzc5NTQsOCBAQCB2b2lkIFNwZWN1bGF0aXZlSklUOjpjb21waWxlU3ByZWFk
KE5vZGUqCiB2b2lkIFNwZWN1bGF0aXZlSklUOjpjb21waWxlTmV3QXJyYXkoTm9kZSogbm9kZSkK
IHsKICAgICBKU0dsb2JhbE9iamVjdCogZ2xvYmFsT2JqZWN0ID0gbV9qaXQuZ3JhcGgoKS5nbG9i
YWxPYmplY3RGb3Iobm9kZS0+b3JpZ2luLnNlbWFudGljKTsKKyAgICBSZWdpc3RlcmVkU3RydWN0
dXJlIHN0cnVjdHVyZSA9IG1faml0LmdyYXBoKCkucmVnaXN0ZXJTdHJ1Y3R1cmUoZ2xvYmFsT2Jq
ZWN0LT5hcnJheVN0cnVjdHVyZUZvckluZGV4aW5nVHlwZUR1cmluZ0FsbG9jYXRpb24obm9kZS0+
aW5kZXhpbmdUeXBlKCkpKTsKICAgICBpZiAoIWdsb2JhbE9iamVjdC0+aXNIYXZpbmdBQmFkVGlt
ZSgpICYmICFoYXNBbnlBcnJheVN0b3JhZ2Uobm9kZS0+aW5kZXhpbmdUeXBlKCkpKSB7Ci0gICAg
ICAgIFJlZ2lzdGVyZWRTdHJ1Y3R1cmUgc3RydWN0dXJlID0gbV9qaXQuZ3JhcGgoKS5yZWdpc3Rl
clN0cnVjdHVyZShnbG9iYWxPYmplY3QtPmFycmF5U3RydWN0dXJlRm9ySW5kZXhpbmdUeXBlRHVy
aW5nQWxsb2NhdGlvbihub2RlLT5pbmRleGluZ1R5cGUoKSkpOwogICAgICAgICBERkdfQVNTRVJU
KG1faml0LmdyYXBoKCksIG5vZGUsIHN0cnVjdHVyZS0+aW5kZXhpbmdUeXBlKCkgPT0gbm9kZS0+
aW5kZXhpbmdUeXBlKCksIHN0cnVjdHVyZS0+aW5kZXhpbmdUeXBlKCksIG5vZGUtPmluZGV4aW5n
VHlwZSgpKTsKICAgICAgICAgQVNTRVJUKAogICAgICAgICAgICAgaGFzVW5kZWNpZGVkKHN0cnVj
dHVyZS0+aW5kZXhpbmdUeXBlKCkpCkBAIC04MDI4LDcgKzgwMjgsNyBAQCB2b2lkIFNwZWN1bGF0
aXZlSklUOjpjb21waWxlTmV3QXJyYXkoTm9kCiAgICAgaWYgKCFub2RlLT5udW1DaGlsZHJlbigp
KSB7CiAgICAgICAgIGZsdXNoUmVnaXN0ZXJzKCk7CiAgICAgICAgIEdQUkZsdXNoZWRDYWxsUmVz
dWx0IHJlc3VsdCh0aGlzKTsKLSAgICAgICAgY2FsbE9wZXJhdGlvbihvcGVyYXRpb25OZXdFbXB0
eUFycmF5LCByZXN1bHQuZ3ByKCksIG1faml0LmdyYXBoKCkucmVnaXN0ZXJTdHJ1Y3R1cmUoZ2xv
YmFsT2JqZWN0LT5hcnJheVN0cnVjdHVyZUZvckluZGV4aW5nVHlwZUR1cmluZ0FsbG9jYXRpb24o
bm9kZS0+aW5kZXhpbmdUeXBlKCkpKSk7CisgICAgICAgIGNhbGxPcGVyYXRpb24ob3BlcmF0aW9u
TmV3RW1wdHlBcnJheSwgcmVzdWx0LmdwcigpLCBzdHJ1Y3R1cmUpOwogICAgICAgICBtX2ppdC5l
eGNlcHRpb25DaGVjaygpOwogICAgICAgICBjZWxsUmVzdWx0KHJlc3VsdC5ncHIoKSwgbm9kZSk7
CiAgICAgICAgIHJldHVybjsK
</data>
<flag name="review"
          id="394772"
          type_id="1"
          status="+"
          setter="ysuzuki"
    />
          </attachment>
      

    </bug>

</bugzilla>