95859 2012-09-05 08:39:28 -0700 [BlackBerry] JavaScriptVariant can crash when operator= is called with itself 2012-09-05 13:58:34 -0700 1 1 1 Unclassified WebKit WebKit BlackBerry 528+ (Nightly build) Other Other RESOLVED FIXED P2 Normal --- 0 ben webkit-unassigned mifenton tonikitoo webkit.review.bot oldest_to_newest 712088 0 ben 2012-09-05 08:39:28 -0700 When JavaScriptVariant contains a string and operator= is called with itself the memory will be free'd in 'this' and then a copy will be attempted from 'that' resulting in a crash. 712104 1 162261 ben 2012-09-05 08:55:38 -0700 Created attachment 162261 patch 712511 2 162261 webkit.review.bot 2012-09-05 13:58:31 -0700 Comment on attachment 162261 patch Clearing flags on attachment: 162261 Committed r127644: <http://trac.webkit.org/changeset/127644> 712512 3 webkit.review.bot 2012-09-05 13:58:34 -0700 All reviewed patches have been landed. Closing bug. 162261 2012-09-05 08:55:38 -0700 2012-09-05 13:58:31 -0700 patch 0001-.patch text/plain 1776 ben RnJvbSA1OGMzOTkwMjMwY2Q5NTliM2Q2NTk3ZTc0ODIwMTcwMjYwOTM0NDgwIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBCZW5qYW1pbiBDIE1leWVyIDxibWV5ZXJAcmltLmNvbT4KRGF0 ZTogV2VkLCA1IFNlcCAyMDEyIDExOjQ1OjI1IC0wNDAwClN1YmplY3Q6IFtQQVRDSF0gLgoKLS0t CiBTb3VyY2UvV2ViS2l0L2JsYWNrYmVycnkvQXBpL0phdmFTY3JpcHRWYXJpYW50LmNwcCB8ICAg IDMgKysrCiBTb3VyY2UvV2ViS2l0L2JsYWNrYmVycnkvQ2hhbmdlTG9nICAgICAgICAgICAgICAg ICB8ICAgMTMgKysrKysrKysrKysrKwogMiBmaWxlcyBjaGFuZ2VkLCAxNiBpbnNlcnRpb25zKCsp LCAwIGRlbGV0aW9ucygtKQoKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQvYmxhY2tiZXJyeS9B cGkvSmF2YVNjcmlwdFZhcmlhbnQuY3BwIGIvU291cmNlL1dlYktpdC9ibGFja2JlcnJ5L0FwaS9K YXZhU2NyaXB0VmFyaWFudC5jcHAKaW5kZXggMTk2N2FlMC4uNWM0MzM4NyAxMDA2NDQKLS0tIGEv U291cmNlL1dlYktpdC9ibGFja2JlcnJ5L0FwaS9KYXZhU2NyaXB0VmFyaWFudC5jcHAKKysrIGIv U291cmNlL1dlYktpdC9ibGFja2JlcnJ5L0FwaS9KYXZhU2NyaXB0VmFyaWFudC5jcHAKQEAgLTE0 Nyw2ICsxNDcsOSBAQCBKYXZhU2NyaXB0VmFyaWFudDo6fkphdmFTY3JpcHRWYXJpYW50KCkKIAog SmF2YVNjcmlwdFZhcmlhbnQmIEphdmFTY3JpcHRWYXJpYW50OjpvcGVyYXRvcj0oY29uc3QgSmF2 YVNjcmlwdFZhcmlhbnQmIHYpCiB7CisgICAgaWYgKCZ2ID09IHRoaXMpCisgICAgICAgIHJldHVy biAqdGhpczsKKwogICAgIHN3aXRjaCAodi50eXBlKCkpIHsKICAgICBjYXNlIEJvb2xlYW46CiAg ICAgICAgIHNldEJvb2xlYW4odi5ib29sZWFuVmFsdWUoKSk7CmRpZmYgLS1naXQgYS9Tb3VyY2Uv V2ViS2l0L2JsYWNrYmVycnkvQ2hhbmdlTG9nIGIvU291cmNlL1dlYktpdC9ibGFja2JlcnJ5L0No YW5nZUxvZwppbmRleCBlY2IwMjE5Li43ZjYxM2ZhIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViS2l0 L2JsYWNrYmVycnkvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XZWJLaXQvYmxhY2tiZXJyeS9DaGFu Z2VMb2cKQEAgLTEsMyArMSwxNiBAQAorMjAxMi0wOS0wNSAgQmVuamFtaW4gQyBNZXllciAgPGJt ZXllckByaW0uY29tPgorCisgICAgICAgIFtCbGFja0JlcnJ5XSBKYXZhU2NyaXB0VmFyaWFudCBj YW4gY3Jhc2ggd2hlbiBvcGVyYXRvcj0gaXMgY2FsbGVkIHdpdGggaXRzZWxmCisgICAgICAgIGh0 dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD05NTg1OQorCisgICAgICAgIFJl dmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogQXBpL0phdmFTY3JpcHRWYXJp YW50LmNwcDoKKyAgICAgICAgKEJsYWNrQmVycnk6OldlYktpdDo6SmF2YVNjcmlwdFZhcmlhbnQ6 Om9wZXJhdG9yPSk6CisgICAgICAgIFdoZW4gSmF2YVNjcmlwdFZhcmlhbnQgY29udGFpbnMgYSBz dHJpbmcgYW5kIG9wZXJhdG9yPSBpcworICAgICAgICBjYWxsZWQgd2l0aCBpdHNlbGYgdGhlIG1l bW9yeSB3aWxsIGJlIGZyZWUnZCBpbiAndGhpcycgYW5kCisgICAgICAgIHRoZW4gYSBjb3B5IHdp bGwgYmUgYXR0ZW1wdGVkIGZyb20gJ3RoYXQnIHJlc3VsdGluZyBpbiBhIGNyYXNoLgorCiAyMDEy LTA5LTA0ICBNYXJ5IFd1ICA8bWFyeS53dUB0b3JjaG1vYmlsZS5jb20uY24+CiAKICAgICAgICAg W0JsYWNrQmVycnldIEFkZCB3ZWJwbGF0Zm9ybSBhbmQgYnJvd3NlciB0byBidWlsZCBpbmZvCi0t IAoxLjcuMQoK