217634 2020-10-12 14:28:21 -0700 Array.prototype.sort's sortBucketSort accesses an array in an invalid way that can lead to incorrect results with indexed properties on the prototype chain 2020-10-12 16:21:31 -0700 1 1 1 Unclassified WebKit JavaScriptCore Other Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 saam saam benjamin cffsmith ews-watchlist fpizlo ggaren gskachkov guijemont joepeck jsc32 keith_miller mark.lam msaboff rmorisset ross.kirsling ticaiolima tzagallo webkit-bug-importer ysuzuki oldest_to_newest 1697030 0 saam 2020-10-12 14:28:21 -0700 ... 1697031 1 saam 2020-10-12 14:28:53 -0700 <rdar://problem/69489404> 1697049 2 411162 saam 2020-10-12 14:53:50 -0700 Created attachment 411162 patch 1697055 3 411162 ysuzuki 2020-10-12 14:56:37 -0700 Comment on attachment 411162 patch r=me 1697103 4 saam 2020-10-12 16:13:51 -0700 *** Bug 217516 has been marked as a duplicate of this bug. *** 1697107 5 ews-feeder 2020-10-12 16:21:29 -0700 Committed r268375: <https://trac.webkit.org/changeset/268375> All reviewed patches have been landed. Closing bug and clearing flags on attachment 411162. 411162 2020-10-12 14:53:50 -0700 2020-10-12 16:21:30 -0700 patch c-backup.diff text/plain 3210 saam SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyNjgzNjgpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDE0IEBACisyMDIwLTEwLTEyICBTYWFtIEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUu Y29tPgorCisgICAgICAgIEFycmF5LnByb3RvdHlwZS5zb3J0J3Mgc29ydEJ1Y2tldFNvcnQgYWNj ZXNzZXMgYW4gYXJyYXkgaW4gYW4gaW52YWxpZCB3YXkgdGhhdCBjYW4gbGVhZCB0byBpbmNvcnJl Y3QgcmVzdWx0cyB3aXRoIGluZGV4ZWQgcHJvcGVydGllcyBvbiB0aGUgcHJvdG90eXBlIGNoYWlu CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMTc2MzQK KyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzY5NDg5NDA0PgorCisgICAgICAgIFJldmlld2VkIGJ5 IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogc3RyZXNzL3NvcnQtc2hvdWxkLW5vdC1sb29r LXVwLXByb3RvdHlwZS1wcm9wZXJ0aWVzLmpzOiBBZGRlZC4KKyAgICAgICAgKGFzc2VydCk6CisK IDIwMjAtMTAtMTEgIFl1c3VrZSBTdXp1a2kgIDx5c3V6dWtpQGFwcGxlLmNvbT4KIAogICAgICAg ICBbSlNDXSBhcmd1bWVudHMuY2FsbGVlIHNob3VsZCBiZWNvbWUgVGhyb3dUeXBlRXJyb3IgaWYg ZnVuY3Rpb24gaGFzIG5vbiBzaW1wbGUgcGFyYW1ldGVyIGxpc3QKSW5kZXg6IEpTVGVzdHMvc3Ry ZXNzL3NvcnQtc2hvdWxkLW5vdC1sb29rLXVwLXByb3RvdHlwZS1wcm9wZXJ0aWVzLmpzCj09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT0KLS0tIEpTVGVzdHMvc3RyZXNzL3NvcnQtc2hvdWxkLW5vdC1sb29rLXVwLXByb3RvdHlw ZS1wcm9wZXJ0aWVzLmpzCShub25leGlzdGVudCkKKysrIEpTVGVzdHMvc3RyZXNzL3NvcnQtc2hv dWxkLW5vdC1sb29rLXVwLXByb3RvdHlwZS1wcm9wZXJ0aWVzLmpzCSh3b3JraW5nIGNvcHkpCkBA IC0wLDAgKzEsMTUgQEAKKy8vIFRoaXMgc2hvdWxkIG5vdCBjcmFzaC4KKworZnVuY3Rpb24gYXNz ZXJ0KGIpIHsKKyAgICBpZiAoIWIpCisgICAgICAgIHRocm93IG5ldyBFcnJvcjsKK30KKworeCA9 IEFycmF5LnByb3RvdHlwZTsKKworZm9yIChsZXQgaSA9IDA7IGkgPCAxMDA7IGkrKykgeworICAg IHhbNTBdID0gMTsKKyAgICB4LnNvcnQoKTsKKyAgICBpZiAoaSA8PSA1MCkKKyAgICAgICAgYXNz ZXJ0KHhbaV0gPT09IDEpOworfQpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxv Zwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCShyZXZpc2lv biAyNjgzNjMpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNv cHkpCkBAIC0xLDMgKzEsMjIgQEAKKzIwMjAtMTAtMTIgIFNhYW0gQmFyYXRpICA8c2JhcmF0aUBh cHBsZS5jb20+CisKKyAgICAgICAgQXJyYXkucHJvdG90eXBlLnNvcnQncyBzb3J0QnVja2V0U29y dCBhY2Nlc3NlcyBhbiBhcnJheSBpbiBhbiBpbnZhbGlkIHdheSB0aGF0IGNhbiBsZWFkIHRvIGlu Y29ycmVjdCByZXN1bHRzIHdpdGggaW5kZXhlZCBwcm9wZXJ0aWVzIG9uIHRoZSBwcm90b3R5cGUg Y2hhaW4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIx NzYzNAorICAgICAgICA8cmRhcjovL3Byb2JsZW0vNjk0ODk0MDQ+CisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgSW5zaWRlIG9uZSBvZiBBcnJheS5wcm90 b3R5cGUuc29ydCdzIGJ1aWx0aW4gaGVscGVyIG1ldGhvZHMsIHdlIGFyZSB1c2luZyBhbgorICAg ICAgICBhcnJheSBhcyBhbiBpbnRlcm5hbCBkYXRhIHN0cnVjdHVyZSB0byBkbyBzb21lIGJvb2tr ZWVwaW5nLiBIb3dldmVyLCB3ZSB3ZXJlCisgICAgICAgIGFjY2Vzc2luZyBpdCBpbiBzdWNoIGEg d2F5IHRoYXQgaXQgd2FzIHJlYWRpbmcgcHJvcGVydGllcyBmcm9tIHRoZSBwcm90b3R5cGUKKyAg ICAgICAgY2hhaW4uIFRoZSBjb2RlIGlzIHdyaXR0ZW4gaW4gYSB3YXkgc3VjaCB0aGF0IGl0IGlz IG9ubHkgY29ycmVjdCBpZiBpdCBpcworICAgICAgICByZWFkaW5nIHNlbGYgcHJvcGVydGllcyAo YXMgdGhlIHByb3RvdHlwZSBjaGFpbiBjYW4gYmUgdXNlciBjb250cm9sbGVkKS4gVGhlCisgICAg ICAgIGZpeCBpcyB0byBzZXQgdGhpcyBib29ra2VlcGluZyBhcnJheSdzIF9fcHJvdG9fXyB0byBu dWxsLCBzbyB3ZSBkb24ndCByZWFkCisgICAgICAgIGZyb20gdGhlIHByb3RvdHlwZSBjaGFpbi4K KworICAgICAgICAqIGJ1aWx0aW5zL0FycmF5UHJvdG90eXBlLmpzOgorICAgICAgICAoZ2xvYmFs UHJpdmF0ZS5zb3J0QnVja2V0U29ydCk6CisKIDIwMjAtMTAtMTIgIEx1bWluZyBZaW4gIDxsdW1p bmdfeWluQGFwcGxlLmNvbT4KIAogICAgICAgICBbbWFjT1NdIFdvcmthcm91bmQgZm9yIE1BQ19P U19YX1ZFUlNJT05fTUFKT1IgaW5jb3JyZWN0bHkgaW5jbHVkaW5nIG1pbm9yIHZlcnNpb24gd2hl biBidWlsZGluZyAKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9idWlsdGlucy9BcnJheVBy b3RvdHlwZS5qcwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYnVpbHRpbnMv QXJyYXlQcm90b3R5cGUuanMJKHJldmlzaW9uIDI2ODM2MykKKysrIFNvdXJjZS9KYXZhU2NyaXB0 Q29yZS9idWlsdGlucy9BcnJheVByb3RvdHlwZS5qcwkod29ya2luZyBjb3B5KQpAQCAtNDUwLDYg KzQ1MCw3IEBAIGZ1bmN0aW9uIHNvcnRCdWNrZXRTb3J0KGFycmF5LCBkc3QsIGJ1Y2sKICAgICB9 CiAKICAgICB2YXIgYnVja2V0cyA9IFsgXTsKKyAgICBAc2V0UHJvdG90eXBlRGlyZWN0LkBjYWxs KGJ1Y2tldHMsIG51bGwpOwogICAgIGZvciAodmFyIGkgPSAwOyBpIDwgYnVja2V0Lmxlbmd0aDsg KytpKSB7CiAgICAgICAgIHZhciBlbnRyeSA9IGJ1Y2tldFtpXTsKICAgICAgICAgdmFyIHN0cmlu ZyA9IGVudHJ5LnN0cmluZzsK