20577 2008-08-31 03:26:57 -0700 REGRESSION (r36006): Gmail is broken 2008-09-01 10:12:52 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Mac OS X 10.5 RESOLVED FIXED HasReduction, Regression P1 Normal --- 1 ismail zwarich darin zwarich oldest_to_newest 89794 0 ismail 2008-08-31 03:26:57 -0700 After r36006 trying do anything from GMail interface throws a GMail #500 error, can't delete spam messages etc. Tested FF successfully. 89795 1 ismail 2008-08-31 03:50:51 -0700 I was too fast to blame Darin on this, sorry! r36005 is not working either. 89796 2 ismail 2008-08-31 04:14:51 -0700 Ok apperently my build script did a svn up before building so it was building r35006 instead of r35005. I fixed the script and indeed the problem is in r35006. CC'in Darin again. Sorry for the mess. 89808 3 zwarich 2008-08-31 13:00:23 -0700 I can confirm this. 89810 4 dev+webkit 2008-08-31 13:23:27 -0700 I'm assuming Cameron already knows this, but I'll mention it here for future reference - this is what's hit when loading GMail: ASSERTION FAILED: offset + length <= static_cast<unsigned>(s.size()) (/Users/matt/Code/WebKit/JavaScriptCore/kjs/JSString.cpp:135 KJS::JSString* KJS::jsSubstring(KJS::ExecState*, const KJS::UString&, unsigned int, unsigned int)) Thread 0 Crashed: 0 com.apple.JavaScriptCore 0x00485282 KJS::jsSubstring(KJS::ExecState*, KJS::UString const&, unsigned int, unsigned int) + 238 (JSString.cpp:135) 1 com.apple.JavaScriptCore 0x004858f3 KJS::stringProtoFuncSubstr(KJS::ExecState*, KJS::JSObject*, KJS::JSValue*, KJS::ArgList const&) + 571 (StringPrototype.cpp:578) 2 com.apple.JavaScriptCore 0x0050b1bb KJS::Machine::privateExecute(KJS::Machine::ExecutionFlag, KJS::ExecState*, KJS::RegisterFile*, KJS::Register*, KJS::ScopeChainNode*, KJS::CodeBlock*, KJS::JSValue**) + 30083 (Machine.cpp:2484) 3 com.apple.JavaScriptCore 0x0050d286 KJS::Machine::execute(KJS::FunctionBodyNode*, KJS::ExecState*, KJS::JSFunction*, KJS::JSObject*, KJS::ArgList const&, KJS::ScopeChainNode*, KJS::JSValue**) + 716 (Machine.cpp:857) 4 com.apple.JavaScriptCore 0x0046aa2b KJS::JSFunction::call(KJS::ExecState*, KJS::JSValue*, KJS::ArgList const&) + 139 (JSFunction.cpp:71) 5 com.apple.JavaScriptCore 0x0046aac7 KJS::call(KJS::ExecState*, KJS::JSValue*, KJS::CallType, KJS::CallData const&, KJS::JSValue*, KJS::ArgList const&) + 149 (CallData.cpp:39) 6 com.apple.JavaScriptCore 0x00479112 KJS::functionProtoFuncApply(KJS::ExecState*, KJS::JSObject*, KJS::JSValue*, KJS::ArgList const&) + 494 (FunctionPrototype.cpp:107) 7 com.apple.JavaScriptCore 0x0050b1bb KJS::Machine::privateExecute(KJS::Machine::ExecutionFlag, KJS::ExecState*, KJS::RegisterFile*, KJS::Register*, KJS::ScopeChainNode*, KJS::CodeBlock*, KJS::JSValue**) + 30083 (Machine.cpp:2484) [snip] 89812 5 zwarich 2008-08-31 13:44:46 -0700 Here is a reduction from Gmail that works on the console: "GMAIL_IMP=bf-i%2Fd-0-0%2Ftl-v".substr(10) 89814 6 zwarich 2008-08-31 13:58:07 -0700 The problem is basically that stringProtoFuncSubstr() was written to do its index calculations for the UString::substr() method, which, like the JS function substr, ignores lengths that are too long. Just plugging in jsSubstring doesn't quite work unless the index computations are changed to never overflow the length of the string. I'll assign this to myself, because Darin is probably with his family. There are similar replacements of UString::substr() with jsSubstring() throughout Darin's patch, so after this is fixed it might be a good idea to go through and check that all of them won't fall prey to the same problem in unusual situations. 89819 7 23092 zwarich 2008-08-31 14:47:05 -0700 Created attachment 23092 Proposed patch 89820 8 23092 mjs 2008-08-31 14:48:47 -0700 Comment on attachment 23092 Proposed patch r=me 89821 9 zwarich 2008-08-31 15:00:27 -0700 Landed in r36009. I'll make a separate bug to check the other cases where UString::substr() was removed. 89826 10 darin 2008-08-31 16:35:52 -0700 (In reply to comment #9) > Landed in r36009. I'll make a separate bug to check the other cases where > UString::substr() was removed. Thanks. This was the perfect fix. For what it's worth, I did fix some call sites that used to rely on substr's range checking; I just missed this one. I hope I didn't miss others. 23092 2008-08-31 14:47:05 -0700 2008-08-31 14:48:47 -0700 Proposed patch substr.diff text/plain 6266 zwarich SW5kZXg6IEphdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKYXZhU2NyaXB0 Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDM2MDA4KQorKysgSmF2YVNjcmlwdENvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTkgQEAKKzIwMDgtMDgtMzEgIENhbWVyb24g WndhcmljaCAgPGN3endhcmljaEB1d2F0ZXJsb28uY2E+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkg Tk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQnVnIDIwNTc3OiBSRUdSRVNTSU9OIChyMzUwMDYp OiBHbWFpbCBpcyBicm9rZW4KKyAgICAgICAgPGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3df YnVnLmNnaT9pZD0yMDU3Nz4KKworICAgICAgICByMzUwMDYgY2hhbmdlZCBzdHJpbmdQcm90b0Z1 bmNTdWJzdHIoKSBzbyB0aGF0IGl0IGlzIHVzZXMgdGhlIG1vcmUKKyAgICAgICAgZWZmaWNpZW50 IGpzU3Vic3RyaW5nKCksIHJhdGhlciB0aGFuIHVzaW5nIFVTdHJpbmc6OnN1YnN0cigpIGFuZCB0 aGVuCisgICAgICAgIGNhbGxpbmcganNTdHJpbmcoKS4gSG93ZXZlciwgdGhlIGNoYW5nZSBkaWQg bm90IGFjY291bnQgZm9yIHRoZSBjYXNlCisgICAgICAgIHdoZXJlIHRoZSBzdGFydCBhbmQgdGhl IGxlbmd0aCBvZiB0aGUgc3Vic3RyaW5nIGV4dGVuZCBwYXN0IHRoZSBsZW5ndGgKKyAgICAgICAg b2YgdGhlIG9yaWdpbmFsIHN0cmluZy4gVGhpcyByZXZpc2lvbiBjb3JyZWN0cyB0aGF0LgorCisg ICAgICAgICoga2pzL1N0cmluZ1Byb3RvdHlwZS5jcHA6CisgICAgICAgIChLSlM6OnN0cmluZ1By b3RvRnVuY1N1YnN0cik6CisKIDIwMDgtMDgtMzEgIFNpbW9uIEhhdXNtYW5uICA8aGF1c21hbm5A d2VraXQub3JnPgogCiAgICAgICAgIFVucmV2aWV3ZWQgYnVpbGQgZml4ICh3aXRoIGdjYyA0LjMp CkluZGV4OiBKYXZhU2NyaXB0Q29yZS9ranMvU3RyaW5nUHJvdG90eXBlLmNwcAo9PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 Ci0tLSBKYXZhU2NyaXB0Q29yZS9ranMvU3RyaW5nUHJvdG90eXBlLmNwcAkocmV2aXNpb24gMzYw MDgpCisrKyBKYXZhU2NyaXB0Q29yZS9ranMvU3RyaW5nUHJvdG90eXBlLmNwcAkod29ya2luZyBj b3B5KQpAQCAtNTY0LDE3ICs1NjQsMTUgQEAgSlNWYWx1ZSogc3RyaW5nUHJvdG9GdW5jU3Vic3Ry KEV4ZWNTdGF0ZQogCiAgICAgZG91YmxlIHN0YXJ0ID0gYTAtPnRvSW50ZWdlcihleGVjKTsKICAg ICBkb3VibGUgbGVuZ3RoID0gYTEtPmlzVW5kZWZpbmVkKCkgPyBsZW4gOiBhMS0+dG9JbnRlZ2Vy KGV4ZWMpOwotICAgIGlmIChzdGFydCA+PSBsZW4pCi0gICAgICAgIHJldHVybiBqc0VtcHR5U3Ry aW5nKGV4ZWMpOwotICAgIGlmIChsZW5ndGggPCAwKQorICAgIGlmIChzdGFydCA+PSBsZW4gfHwg bGVuZ3RoIDw9IDApCiAgICAgICAgIHJldHVybiBqc0VtcHR5U3RyaW5nKGV4ZWMpOwogICAgIGlm IChzdGFydCA8IDApIHsKICAgICAgICAgc3RhcnQgKz0gbGVuOwogICAgICAgICBpZiAoc3RhcnQg PCAwKQogICAgICAgICAgICAgc3RhcnQgPSAwOwogICAgIH0KLSAgICBpZiAobGVuZ3RoID4gbGVu KQotICAgICAgICBsZW5ndGggPSBsZW47CisgICAgaWYgKHN0YXJ0ICsgbGVuZ3RoID4gbGVuKQor ICAgICAgICBsZW5ndGggPSBsZW4gLSBzdGFydDsKICAgICByZXR1cm4ganNTdWJzdHJpbmcoZXhl Yywgcywgc3RhdGljX2Nhc3Q8dW5zaWduZWQ+KHN0YXJ0KSwgc3RhdGljX2Nhc3Q8dW5zaWduZWQ+ KGxlbmd0aCkpOwogfQogCkluZGV4OiBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cKPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0gTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCShyZXZpc2lvbiAzNjAwOCkKKysrIExheW91dFRlc3Rz L0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBACisyMDA4LTA4LTMxICBD YW1lcm9uIFp3YXJpY2ggIDxjd3p3YXJpY2hAdXdhdGVybG9vLmNhPgorCisgICAgICAgIFJldmll d2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRlc3RzIGZvciBidWcgMjA1Nzc6IFJF R1JFU1NJT04gKHIzNTAwNik6IEdtYWlsIGlzIGJyb2tlbgorICAgICAgICA8aHR0cHM6Ly9idWdz LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIwNTc3PgorCisgICAgICAgICogZmFzdC9qcy9y ZXNvdXJjZXMvc3RyaW5nLXN1YnN0ci5qczogQWRkZWQuCisgICAgICAgICogZmFzdC9qcy9zdHJp bmctc3Vic3RyLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogZmFzdC9qcy9zdHJpbmct c3Vic3RyLmh0bWw6IEFkZGVkLgorCiAyMDA4LTA4LTMwICBEYXJpbiBBZGxlciAgPGRhcmluQGFw cGxlLmNvbT4KIAogICAgICAgICBSZXZpZXdlZCBieSBNYWNpZWouCkluZGV4OiBMYXlvdXRUZXN0 cy9mYXN0L2pzL3N0cmluZy1zdWJzdHItZXhwZWN0ZWQudHh0Cj09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91 dFRlc3RzL2Zhc3QvanMvc3RyaW5nLXN1YnN0ci1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCisr KyBMYXlvdXRUZXN0cy9mYXN0L2pzL3N0cmluZy1zdWJzdHItZXhwZWN0ZWQudHh0CShyZXZpc2lv biAwKQpAQCAtMCwwICsxLDQwIEBACitUaGlzIHRlc3QgY2hlY2tzIHRoZSBib3VuZGFyeSBjYXNl cyBvZiBzdWJzdHIoKS4KKworT24gc3VjY2VzcywgeW91IHdpbGwgc2VlIGEgc2VyaWVzIG9mICJQ QVNTIiBtZXNzYWdlcywgZm9sbG93ZWQgYnkgIlRFU1QgQ09NUExFVEUiLgorCisKK1BBU1MgJ2Jh cicuc3Vic3RyKDApIGlzICdiYXInCitQQVNTICdiYXInLnN1YnN0cigzKSBpcyAnJworUEFTUyAn YmFyJy5zdWJzdHIoNCkgaXMgJycKK1BBU1MgJ2Jhcicuc3Vic3RyKC0xKSBpcyAncicKK1BBU1Mg J2Jhcicuc3Vic3RyKC0zKSBpcyAnYmFyJworUEFTUyAnYmFyJy5zdWJzdHIoLTQpIGlzICdiYXIn CitQQVNTICdiYXInLnN1YnN0cigwLCAwKSBpcyAnJworUEFTUyAnYmFyJy5zdWJzdHIoMCwgMSkg aXMgJ2InCitQQVNTICdiYXInLnN1YnN0cigwLCAzKSBpcyAnYmFyJworUEFTUyAnYmFyJy5zdWJz dHIoMCwgNCkgaXMgJ2JhcicKK1BBU1MgJ2Jhcicuc3Vic3RyKDEsIDApIGlzICcnCitQQVNTICdi YXInLnN1YnN0cigxLCAxKSBpcyAnYScKK1BBU1MgJ2Jhcicuc3Vic3RyKDEsIDIpIGlzICdhcicK K1BBU1MgJ2Jhcicuc3Vic3RyKDEsIDMpIGlzICdhcicKK1BBU1MgJ2Jhcicuc3Vic3RyKDMsIDAp IGlzICcnCitQQVNTICdiYXInLnN1YnN0cigzLCAxKSBpcyAnJworUEFTUyAnYmFyJy5zdWJzdHIo MywgMykgaXMgJycKK1BBU1MgJ2Jhcicuc3Vic3RyKDQsIDApIGlzICcnCitQQVNTICdiYXInLnN1 YnN0cig0LCAxKSBpcyAnJworUEFTUyAnYmFyJy5zdWJzdHIoNCwgMykgaXMgJycKK1BBU1MgJ2Jh cicuc3Vic3RyKC0xLCAwKSBpcyAnJworUEFTUyAnYmFyJy5zdWJzdHIoLTEsIDEpIGlzICdyJwor UEFTUyAnYmFyJy5zdWJzdHIoLTMsIDEpIGlzICdiJworUEFTUyAnYmFyJy5zdWJzdHIoLTMsIDMp IGlzICdiYXInCitQQVNTICdiYXInLnN1YnN0cigtMywgNCkgaXMgJ2JhcicKK1BBU1MgJ2Jhcicu c3Vic3RyKC00KSBpcyAnYmFyJworUEFTUyAnYmFyJy5zdWJzdHIoLTQsIDApIGlzICcnCitQQVNT ICdiYXInLnN1YnN0cigtNCwgMSkgaXMgJ2InCitQQVNTICdiYXInLnN1YnN0cigtNCwgMykgaXMg J2JhcicKK1BBU1MgJ2Jhcicuc3Vic3RyKC00LCA0KSBpcyAnYmFyJworUEFTUyAnR01BSUxfSU1Q PWJmLWklMkZkLTAtMCUyRnRsLXYnLnN1YnN0cigxMCkgaXMgJ2JmLWklMkZkLTAtMCUyRnRsLXYn CitQQVNTIHN1Y2Nlc3NmdWxseVBhcnNlZCBpcyB0cnVlCisKK1RFU1QgQ09NUExFVEUKKwpJbmRl eDogTGF5b3V0VGVzdHMvZmFzdC9qcy9zdHJpbmctc3Vic3RyLmh0bWwKPT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0g TGF5b3V0VGVzdHMvZmFzdC9qcy9zdHJpbmctc3Vic3RyLmh0bWwJKHJldmlzaW9uIDApCisrKyBM YXlvdXRUZXN0cy9mYXN0L2pzL3N0cmluZy1zdWJzdHIuaHRtbAkocmV2aXNpb24gMCkKQEAgLTAs MCArMSwxMyBAQAorPCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9JRVRGLy9EVEQgSFRNTC8vRU4i PgorPGh0bWw+Cis8aGVhZD4KKzxsaW5rIHJlbD0ic3R5bGVzaGVldCIgaHJlZj0icmVzb3VyY2Vz L2pzLXRlc3Qtc3R5bGUuY3NzIj4KKzxzY3JpcHQgc3JjPSJyZXNvdXJjZXMvanMtdGVzdC1wcmUu anMiPjwvc2NyaXB0PgorPC9oZWFkPgorPGJvZHk+Cis8cCBpZD0iZGVzY3JpcHRpb24iPjwvcD4K KzxkaXYgaWQ9ImNvbnNvbGUiPjwvZGl2PgorPHNjcmlwdCBzcmM9InJlc291cmNlcy9zdHJpbmct c3Vic3RyLmpzIj48L3NjcmlwdD4KKzxzY3JpcHQgc3JjPSJyZXNvdXJjZXMvanMtdGVzdC1wb3N0 LmpzIj48L3NjcmlwdD4KKzwvYm9keT4KKzwvaHRtbD4KSW5kZXg6IExheW91dFRlc3RzL2Zhc3Qv anMvcmVzb3VyY2VzL3N0cmluZy1zdWJzdHIuanMKPT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMv ZmFzdC9qcy9yZXNvdXJjZXMvc3RyaW5nLXN1YnN0ci5qcwkocmV2aXNpb24gMCkKKysrIExheW91 dFRlc3RzL2Zhc3QvanMvcmVzb3VyY2VzL3N0cmluZy1zdWJzdHIuanMJKHJldmlzaW9uIDApCkBA IC0wLDAgKzEsNDUgQEAKK2Rlc2NyaXB0aW9uKAorIlRoaXMgdGVzdCBjaGVja3MgdGhlIGJvdW5k YXJ5IGNhc2VzIG9mIHN1YnN0cigpLiIKKyk7CisKK3Nob3VsZEJlKCInYmFyJy5zdWJzdHIoMCki LCAiJ2JhciciKTsKK3Nob3VsZEJlKCInYmFyJy5zdWJzdHIoMykiLCAiJyciKTsKK3Nob3VsZEJl KCInYmFyJy5zdWJzdHIoNCkiLCAiJyciKTsKK3Nob3VsZEJlKCInYmFyJy5zdWJzdHIoLTEpIiwg IidyJyIpOworc2hvdWxkQmUoIidiYXInLnN1YnN0cigtMykiLCAiJ2JhciciKTsKK3Nob3VsZEJl KCInYmFyJy5zdWJzdHIoLTQpIiwgIidiYXInIik7CisKK3Nob3VsZEJlKCInYmFyJy5zdWJzdHIo MCwgMCkiLCAiJyciKTsKK3Nob3VsZEJlKCInYmFyJy5zdWJzdHIoMCwgMSkiLCAiJ2InIik7Citz aG91bGRCZSgiJ2Jhcicuc3Vic3RyKDAsIDMpIiwgIidiYXInIik7CitzaG91bGRCZSgiJ2Jhcicu c3Vic3RyKDAsIDQpIiwgIidiYXInIik7CisKK3Nob3VsZEJlKCInYmFyJy5zdWJzdHIoMSwgMCki LCAiJyciKTsKK3Nob3VsZEJlKCInYmFyJy5zdWJzdHIoMSwgMSkiLCAiJ2EnIik7CitzaG91bGRC ZSgiJ2Jhcicuc3Vic3RyKDEsIDIpIiwgIidhciciKTsKK3Nob3VsZEJlKCInYmFyJy5zdWJzdHIo MSwgMykiLCAiJ2FyJyIpOworCitzaG91bGRCZSgiJ2Jhcicuc3Vic3RyKDMsIDApIiwgIicnIik7 CitzaG91bGRCZSgiJ2Jhcicuc3Vic3RyKDMsIDEpIiwgIicnIik7CitzaG91bGRCZSgiJ2Jhcicu c3Vic3RyKDMsIDMpIiwgIicnIik7CisKK3Nob3VsZEJlKCInYmFyJy5zdWJzdHIoNCwgMCkiLCAi JyciKTsKK3Nob3VsZEJlKCInYmFyJy5zdWJzdHIoNCwgMSkiLCAiJyciKTsKK3Nob3VsZEJlKCIn YmFyJy5zdWJzdHIoNCwgMykiLCAiJyciKTsKKworc2hvdWxkQmUoIidiYXInLnN1YnN0cigtMSwg MCkiLCAiJyciKTsKK3Nob3VsZEJlKCInYmFyJy5zdWJzdHIoLTEsIDEpIiwgIidyJyIpOworCitz aG91bGRCZSgiJ2Jhcicuc3Vic3RyKC0zLCAxKSIsICInYiciKTsKK3Nob3VsZEJlKCInYmFyJy5z dWJzdHIoLTMsIDMpIiwgIidiYXInIik7CitzaG91bGRCZSgiJ2Jhcicuc3Vic3RyKC0zLCA0KSIs ICInYmFyJyIpOworCitzaG91bGRCZSgiJ2Jhcicuc3Vic3RyKC00KSIsICInYmFyJyIpOworc2hv dWxkQmUoIidiYXInLnN1YnN0cigtNCwgMCkiLCAiJyciKTsKK3Nob3VsZEJlKCInYmFyJy5zdWJz dHIoLTQsIDEpIiwgIidiJyIpOworc2hvdWxkQmUoIidiYXInLnN1YnN0cigtNCwgMykiLCAiJ2Jh ciciKTsKK3Nob3VsZEJlKCInYmFyJy5zdWJzdHIoLTQsIDQpIiwgIidiYXInIik7CisKK3Nob3Vs ZEJlKCInR01BSUxfSU1QPWJmLWklMkZkLTAtMCUyRnRsLXYnLnN1YnN0cigxMCkiLCAiJ2JmLWkl MkZkLTAtMCUyRnRsLXYnIik7CisKK3ZhciBzdWNjZXNzZnVsbHlQYXJzZWQgPSB0cnVlOwo=