44099 2010-08-17 04:11:28 -0700 REGRESSION(r65468): Crashes in StringImpl::find 2010-08-18 06:49:39 -0700 1 1 1 Unclassified WebKit Web Template Framework 528+ (Nightly build) PC All RESOLVED FIXED P2 Normal --- 44080 1 yutak yutak aroben barraclough commit-queue hamaji oldest_to_newest 265463 0 yutak 2010-08-17 04:11:28 -0700 Since r65468, Chromium buildbots are reporting a lot of crashes inside StringImpl::find. I guess I have found the problem; I'll upload a patch shortly. 265468 1 64573 yutak 2010-08-17 04:29:20 -0700 Created attachment 64573 Patch 265469 2 64573 hamaji 2010-08-17 04:35:58 -0700 Comment on attachment 64573 Patch Looks good. 265475 3 64573 commit-queue 2010-08-17 04:55:11 -0700 Comment on attachment 64573 Patch Clearing flags on attachment: 64573 Committed r65493: <http://trac.webkit.org/changeset/65493> 265476 4 commit-queue 2010-08-17 04:55:16 -0700 All reviewed patches have been landed. Closing bug. 265487 5 yutak 2010-08-17 05:59:37 -0700 Unfortunately, my patch didn't work. Stack trace is available at: http://build.chromium.org/buildbot/waterfall/builders/Chromium%20Reliability/builds/11720/steps/reliability:%20partial%20result%20of%20current%20build/logs/stdio http://build.chromium.org/buildbot/waterfall/builders/Chromium%20Reliability/builds/11721/steps/reliability:%20partial%20result%20of%20current%20build/logs/stdio For now, I'm not sure the real reason why r65468 causes crashes. 265765 6 64573 darin 2010-08-17 14:16:20 -0700 Comment on attachment 64573 Patch I would have preferred a fix that used a break inside the loop rather than repeating the logic from inside the loop. for (unsigned i = 0; ; ++i) { if (searchHash == matchHash && equal(searchCharacters + i, matchString, matchLength)) return index + i; if (i >= delta) break; ... 265807 7 aroben 2010-08-17 15:43:44 -0700 This seems to be happening on Windows, too: http://build.webkit.org/results/Windows%20Debug%20(Tests)/r65537%20(18204)/CrashLog_09b4_2010-08-17_15-14-54-014.txt http://build.webkit.org/results/Windows%20Debug%20(Tests)/r65537%20(18204)/CrashLog_0c14_2010-08-17_15-05-47-171.txt 265828 8 64650 barraclough 2010-08-17 16:14:36 -0700 Created attachment 64650 Fix for second overrun Landed in r65571 265830 9 barraclough 2010-08-17 16:17:35 -0700 Thanks for catching this Yuta. I think the problem is just the overrun, but there is a second find method with the same issue, so I've landed a fix for this. Hopefully this should resolved the remaining crashes. 266083 10 yutak 2010-08-18 06:49:39 -0700 (In reply to comment #9) > Thanks for catching this Yuta. I think the problem is just the overrun, but there is a second find method with the same issue, so I've landed a fix for this. Hopefully this should resolved the remaining crashes. It seems the crashes are gone. Thanks! 64573 2010-08-17 04:29:20 -0700 2010-08-17 14:16:20 -0700 Patch bug-44099-20100817202918.patch text/plain 1572 yutak ZGlmZiAtLWdpdCBhL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZyBiL0phdmFTY3JpcHRDb3JlL0No YW5nZUxvZwppbmRleCAyZTExYzJjNWUzNWUwZjA1MmE2NmY3MWFjZDNjMTkwNWIxMjA3OWNiLi5h YmE0NjUzNjljMzVjM2Q4NDM4YTAzMjg2YzY0MWRlOTViYzdjM2ZkIDEwMDY0NAotLS0gYS9KYXZh U2NyaXB0Q29yZS9DaGFuZ2VMb2cKKysrIGIvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCkBAIC0x LDMgKzEsMTUgQEAKKzIwMTAtMDgtMTcgIFl1dGEgS2l0YW11cmEgIDx5dXRha0BjaHJvbWl1bS5v cmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQXZv aWQgdW5pbml0aWFsaXplZCBtZW1vcnkgcmVhZCBpbiBTdHJpbmdJbXBsOjpmaW5kKCkuCisKKyAg ICAgICAgUkVHUkVTU0lPTihyNjU0NjgpOiBDcmFzaGVzIGluIFN0cmluZ0ltcGw6OmZpbmQKKyAg ICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTQ0MDk5CisKKyAg ICAgICAgKiB3dGYvdGV4dC9TdHJpbmdJbXBsLmNwcDoKKyAgICAgICAgKFdURjo6U3RyaW5nSW1w bDo6ZmluZCk6CisKIDIwMTAtMDgtMTYgIEdhdmluIEJhcnJhY2xvdWdoICA8YmFycmFjbG91Z2hA YXBwbGUuY29tPgogCiAgICAgICAgIFJ1YmJlciBzdGFtcGVkIGJ5IFNhbSBXZWluaWcKZGlmZiAt LWdpdCBhL0phdmFTY3JpcHRDb3JlL3d0Zi90ZXh0L1N0cmluZ0ltcGwuY3BwIGIvSmF2YVNjcmlw dENvcmUvd3RmL3RleHQvU3RyaW5nSW1wbC5jcHAKaW5kZXggYTk0NDQ3MGY0MmQyYzIyMDkxM2U5 ZWRiZTQ4MDE5YTlmNmVjNzAwMS4uZWQwMGEyOTYxNzEyZmI2NmU4NWYwNTcyMjQ0NDA3MjQ1ZDhh ODM3NyAxMDA2NDQKLS0tIGEvSmF2YVNjcmlwdENvcmUvd3RmL3RleHQvU3RyaW5nSW1wbC5jcHAK KysrIGIvSmF2YVNjcmlwdENvcmUvd3RmL3RleHQvU3RyaW5nSW1wbC5jcHAKQEAgLTU0MiwxMiAr NTQyLDE0IEBAIHNpemVfdCBTdHJpbmdJbXBsOjpmaW5kKGNvbnN0IGNoYXIqIG1hdGNoU3RyaW5n LCB1bnNpZ25lZCBpbmRleCkKICAgICAgICAgbWF0Y2hIYXNoICs9IG1hdGNoQ2hhcmFjdGVyc1tp XTsKICAgICB9CiAKLSAgICBmb3IgKHVuc2lnbmVkIGkgPSAwOyBpIDw9IGRlbHRhOyArK2kpIHsK KyAgICBmb3IgKHVuc2lnbmVkIGkgPSAwOyBpIDwgZGVsdGE7ICsraSkgewogICAgICAgICBpZiAo c2VhcmNoSGFzaCA9PSBtYXRjaEhhc2ggJiYgZXF1YWwoc2VhcmNoQ2hhcmFjdGVycyArIGksIG1h dGNoU3RyaW5nLCBtYXRjaExlbmd0aCkpCiAgICAgICAgICAgICByZXR1cm4gaW5kZXggKyBpOwog ICAgICAgICBzZWFyY2hIYXNoICs9IHNlYXJjaENoYXJhY3RlcnNbaSArIG1hdGNoTGVuZ3RoXTsK ICAgICAgICAgc2VhcmNoSGFzaCAtPSBzZWFyY2hDaGFyYWN0ZXJzW2ldOwogICAgIH0KKyAgICBp ZiAoc2VhcmNoSGFzaCA9PSBtYXRjaEhhc2ggJiYgZXF1YWwoc2VhcmNoQ2hhcmFjdGVycyArIGRl bHRhLCBtYXRjaFN0cmluZywgbWF0Y2hMZW5ndGgpKQorICAgICAgICByZXR1cm4gaW5kZXggKyBk ZWx0YTsKICAgICByZXR1cm4gbm90Rm91bmQ7CiB9CiAK 64650 2010-08-17 16:14:36 -0700 2010-08-17 16:14:36 -0700 Fix for second overrun find.overrun.patch text/plain 4845 barraclough SW5kZXg6IEphdmFTY3JpcHRDb3JlL3d0Zi90ZXh0L1N0cmluZ0ltcGwuY3BwCj09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K LS0tIEphdmFTY3JpcHRDb3JlL3d0Zi90ZXh0L1N0cmluZ0ltcGwuY3BwCShyZXZpc2lvbiA2NTU3 MCkKKysrIEphdmFTY3JpcHRDb3JlL3d0Zi90ZXh0L1N0cmluZ0ltcGwuY3BwCShyZXZpc2lvbiA2 NTU3MSkKQEAgLTU0MiwxNSArNTQyLDE2IEBACiAgICAgICAgIG1hdGNoSGFzaCArPSBtYXRjaENo YXJhY3RlcnNbaV07CiAgICAgfQogCi0gICAgZm9yICh1bnNpZ25lZCBpID0gMDsgaSA8IGRlbHRh OyArK2kpIHsKLSAgICAgICAgaWYgKHNlYXJjaEhhc2ggPT0gbWF0Y2hIYXNoICYmIGVxdWFsKHNl YXJjaENoYXJhY3RlcnMgKyBpLCBtYXRjaFN0cmluZywgbWF0Y2hMZW5ndGgpKQotICAgICAgICAg ICAgcmV0dXJuIGluZGV4ICsgaTsKKyAgICB1bnNpZ25lZCBpID0gMDsKKyAgICAvLyBrZWVwIGxv b3BpbmcgdW50aWwgd2UgbWF0Y2gKKyAgICB3aGlsZSAoc2VhcmNoSGFzaCAhPSBtYXRjaEhhc2gg fHwgIWVxdWFsKHNlYXJjaENoYXJhY3RlcnMgKyBpLCBtYXRjaFN0cmluZywgbWF0Y2hMZW5ndGgp KSB7CisgICAgICAgIGlmIChpID09IGRlbHRhKQorICAgICAgICAgICAgcmV0dXJuIG5vdEZvdW5k OwogICAgICAgICBzZWFyY2hIYXNoICs9IHNlYXJjaENoYXJhY3RlcnNbaSArIG1hdGNoTGVuZ3Ro XTsKICAgICAgICAgc2VhcmNoSGFzaCAtPSBzZWFyY2hDaGFyYWN0ZXJzW2ldOworICAgICAgICAr K2k7CiAgICAgfQotICAgIGlmIChzZWFyY2hIYXNoID09IG1hdGNoSGFzaCAmJiBlcXVhbChzZWFy Y2hDaGFyYWN0ZXJzICsgZGVsdGEsIG1hdGNoU3RyaW5nLCBtYXRjaExlbmd0aCkpCi0gICAgICAg IHJldHVybiBpbmRleCArIGRlbHRhOwotICAgIHJldHVybiBub3RGb3VuZDsKKyAgICByZXR1cm4g aW5kZXggKyBpOwogfQogCiBzaXplX3QgU3RyaW5nSW1wbDo6ZmluZElnbm9yaW5nQ2FzZShjb25z dCBjaGFyKiBtYXRjaFN0cmluZywgdW5zaWduZWQgaW5kZXgpCkBAIC01NzMsMTEgKzU3NCwxNCBA QAogCiAgICAgY29uc3QgVUNoYXIqIHNlYXJjaENoYXJhY3RlcnMgPSBjaGFyYWN0ZXJzKCkgKyBp bmRleDsKIAotICAgIGZvciAodW5zaWduZWQgaSA9IDA7IGkgPD0gZGVsdGE7ICsraSkgewotICAg ICAgICBpZiAoZXF1YWxJZ25vcmluZ0Nhc2Uoc2VhcmNoQ2hhcmFjdGVycyArIGksIG1hdGNoU3Ry aW5nLCBtYXRjaExlbmd0aCkpCi0gICAgICAgICAgICByZXR1cm4gaW5kZXggKyBpOworICAgIHVu c2lnbmVkIGkgPSAwOworICAgIC8vIGtlZXAgbG9vcGluZyB1bnRpbCB3ZSBtYXRjaAorICAgIHdo aWxlICghZXF1YWxJZ25vcmluZ0Nhc2Uoc2VhcmNoQ2hhcmFjdGVycyArIGksIG1hdGNoU3RyaW5n LCBtYXRjaExlbmd0aCkpIHsKKyAgICAgICAgaWYgKGkgPT0gZGVsdGEpCisgICAgICAgICAgICBy ZXR1cm4gbm90Rm91bmQ7CisgICAgICAgICsraTsKICAgICB9Ci0gICAgcmV0dXJuIG5vdEZvdW5k OworICAgIHJldHVybiBpbmRleCArIGk7CiB9CiAKIHNpemVfdCBTdHJpbmdJbXBsOjpmaW5kKFN0 cmluZ0ltcGwqIG1hdGNoU3RyaW5nLCB1bnNpZ25lZCBpbmRleCkKQEAgLTYxNCwxMyArNjE4LDE2 IEBACiAgICAgICAgIG1hdGNoSGFzaCArPSBtYXRjaENoYXJhY3RlcnNbaV07CiAgICAgfQogCi0g ICAgZm9yICh1bnNpZ25lZCBpID0gMDsgaSA8PSBkZWx0YTsgKytpKSB7Ci0gICAgICAgIGlmIChz ZWFyY2hIYXNoID09IG1hdGNoSGFzaCAmJiBtZW1jbXAoc2VhcmNoQ2hhcmFjdGVycyArIGksIG1h dGNoQ2hhcmFjdGVycywgbWF0Y2hMZW5ndGggKiBzaXplb2YoVUNoYXIpKSA9PSAwKQotICAgICAg ICAgICAgcmV0dXJuIGluZGV4ICsgaTsKKyAgICB1bnNpZ25lZCBpID0gMDsKKyAgICAvLyBrZWVw IGxvb3BpbmcgdW50aWwgd2UgbWF0Y2gKKyAgICB3aGlsZSAoc2VhcmNoSGFzaCAhPSBtYXRjaEhh c2ggfHwgbWVtY21wKHNlYXJjaENoYXJhY3RlcnMgKyBpLCBtYXRjaENoYXJhY3RlcnMsIG1hdGNo TGVuZ3RoICogc2l6ZW9mKFVDaGFyKSkpIHsKKyAgICAgICAgaWYgKGkgPT0gZGVsdGEpCisgICAg ICAgICAgICByZXR1cm4gbm90Rm91bmQ7CiAgICAgICAgIHNlYXJjaEhhc2ggKz0gc2VhcmNoQ2hh cmFjdGVyc1tpICsgbWF0Y2hMZW5ndGhdOwogICAgICAgICBzZWFyY2hIYXNoIC09IHNlYXJjaENo YXJhY3RlcnNbaV07CisgICAgICAgICsraTsKICAgICB9Ci0gICAgcmV0dXJuIG5vdEZvdW5kOwor ICAgIHJldHVybiBpbmRleCArIGk7CiB9CiAKIHNpemVfdCBTdHJpbmdJbXBsOjpmaW5kSWdub3Jp bmdDYXNlKFN0cmluZ0ltcGwqIG1hdGNoU3RyaW5nLCB1bnNpZ25lZCBpbmRleCkKQEAgLTY0NCwx MSArNjUxLDE0IEBACiAgICAgY29uc3QgVUNoYXIqIHNlYXJjaENoYXJhY3RlcnMgPSBjaGFyYWN0 ZXJzKCkgKyBpbmRleDsKICAgICBjb25zdCBVQ2hhciogbWF0Y2hDaGFyYWN0ZXJzID0gbWF0Y2hT dHJpbmctPmNoYXJhY3RlcnMoKTsKIAotICAgIGZvciAodW5zaWduZWQgaSA9IDA7IGkgPD0gZGVs dGE7ICsraSkgewotICAgICAgICBpZiAoZXF1YWxJZ25vcmluZ0Nhc2Uoc2VhcmNoQ2hhcmFjdGVy cyArIGksIG1hdGNoQ2hhcmFjdGVycywgbWF0Y2hMZW5ndGgpKQotICAgICAgICAgICAgcmV0dXJu IGluZGV4ICsgaTsKKyAgICB1bnNpZ25lZCBpID0gMDsKKyAgICAvLyBrZWVwIGxvb3BpbmcgdW50 aWwgd2UgbWF0Y2gKKyAgICB3aGlsZSAoIWVxdWFsSWdub3JpbmdDYXNlKHNlYXJjaENoYXJhY3Rl cnMgKyBpLCBtYXRjaENoYXJhY3RlcnMsIG1hdGNoTGVuZ3RoKSkgeworICAgICAgICBpZiAoaSA9 PSBkZWx0YSkKKyAgICAgICAgICAgIHJldHVybiBub3RGb3VuZDsKKyAgICAgICAgKytpOwogICAg IH0KLSAgICByZXR1cm4gbm90Rm91bmQ7CisgICAgcmV0dXJuIGluZGV4ICsgaTsKIH0KIAogc2l6 ZV90IFN0cmluZ0ltcGw6OnJldmVyc2VGaW5kKFVDaGFyIGMsIHVuc2lnbmVkIGluZGV4KQpAQCAt Njg3LDkgKzY5NywxMSBAQAogICAgICAgICBtYXRjaEhhc2ggKz0gbWF0Y2hDaGFyYWN0ZXJzW2ld OwogICAgIH0KIAorICAgIC8vIGtlZXAgbG9vcGluZyB1bnRpbCB3ZSBtYXRjaAogICAgIHdoaWxl IChzZWFyY2hIYXNoICE9IG1hdGNoSGFzaCB8fCBtZW1jbXAoc2VhcmNoQ2hhcmFjdGVycyArIGRl bHRhLCBtYXRjaENoYXJhY3RlcnMsIG1hdGNoTGVuZ3RoICogc2l6ZW9mKFVDaGFyKSkpIHsKLSAg ICAgICAgaWYgKCFkZWx0YS0tKQorICAgICAgICBpZiAoIWRlbHRhKQogICAgICAgICAgICAgcmV0 dXJuIG5vdEZvdW5kOworICAgICAgICBkZWx0YS0tOwogICAgICAgICBzZWFyY2hIYXNoIC09IHNl YXJjaENoYXJhY3RlcnNbZGVsdGEgKyBtYXRjaExlbmd0aF07CiAgICAgICAgIHNlYXJjaEhhc2gg Kz0gc2VhcmNoQ2hhcmFjdGVyc1tkZWx0YV07CiAgICAgfQpAQCAtNzE0LDkgKzcyNiwxMSBAQAog ICAgIGNvbnN0IFVDaGFyICpzZWFyY2hDaGFyYWN0ZXJzID0gY2hhcmFjdGVycygpOwogICAgIGNv bnN0IFVDaGFyICptYXRjaENoYXJhY3RlcnMgPSBtYXRjaFN0cmluZy0+Y2hhcmFjdGVycygpOwog CisgICAgLy8ga2VlcCBsb29waW5nIHVudGlsIHdlIG1hdGNoCiAgICAgd2hpbGUgKCFlcXVhbEln bm9yaW5nQ2FzZShzZWFyY2hDaGFyYWN0ZXJzICsgZGVsdGEsIG1hdGNoQ2hhcmFjdGVycywgbWF0 Y2hMZW5ndGgpKSB7Ci0gICAgICAgIGlmICghZGVsdGEtLSkKKyAgICAgICAgaWYgKCFkZWx0YSkK ICAgICAgICAgICAgIHJldHVybiBub3RGb3VuZDsKKyAgICAgICAgZGVsdGEtLTsKICAgICB9CiAg ICAgcmV0dXJuIGRlbHRhOwogfQpJbmRleDogSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCj09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT0KLS0tIEphdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gNjU1NzApCisrKyBK YXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDY1NTcxKQpAQCAtMSwzICsxLDIwIEBA CisyMDEwLTA4LTE3ICBHYXZpbiBCYXJyYWNsb3VnaCAgPGJhcnJhY2xvdWdoQGFwcGxlLmNvbT4K KworICAgICAgICBSZXZpZXdlZCBieSBTYW0gV2VpbmlnLgorCisgICAgICAgIEJ1ZyA0NDA5OSAt IFJFR1JFU1NJT04ocjY1NDY4KTogQ3Jhc2hlcyBpbiBTdHJpbmdJbXBsOjpmaW5kCisKKyAgICAg ICAgQnVnIDQ0MDgwIGludHJvdWR1Y2VkIGEgY291cGxlIG9mIGNhc2VzIGluIHdoaWNoIGFycmF5 IGJvdW5kcyBjb3VsZCBiZSBvdmVycnVuLgorICAgICAgICBPbmUgb2YgdGhlc2Ugd2FzIGZpeGVk IGluIHI2NTQ5MywgdGhpcyBwYXRjaCBmaXhlcyB0aGUgb3RoZXIgYW5kIGFkZHJlc3MgdGhlCisg ICAgICAgIGNvbmNlcm5zIHZvaWNlZCBpbiBjb21tZW50ICM2IGJ5IHJlc3RydWN0dXJpbmcgdGhl IGxvb3BzIHRvIHJlbW92ZSB0aGUgY29kZQorICAgICAgICBkdXBsaWN0aW9uIHdpdGhvdXQgaW50 cm9kdWNpbmcgYW4gYWRkaXRpb25hbCBpZiBjaGVjay4KKworICAgICAgICAqIHd0Zi90ZXh0L1N0 cmluZ0ltcGwuY3BwOgorICAgICAgICAoV1RGOjpTdHJpbmdJbXBsOjpmaW5kKToKKyAgICAgICAg KFdURjo6U3RyaW5nSW1wbDo6ZmluZElnbm9yaW5nQ2FzZSk6CisgICAgICAgIChXVEY6OlN0cmlu Z0ltcGw6OnJldmVyc2VGaW5kKToKKyAgICAgICAgKFdURjo6U3RyaW5nSW1wbDo6cmV2ZXJzZUZp bmRJZ25vcmluZ0Nhc2UpOgorCiAyMDEwLTA4LTE3ICBObydhbSBSb3NlbnRoYWwgIDxub2FtLnJv c2VudGhhbEBub2tpYS5jb20+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgQXJpeWEgSGlkYXlhdC4K