Bug 159227

Summary: JSRopeString should use release asserts, not debug asserts, about substring bounds
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, keith_miller, mark.lam, msaboff, saam
Priority: P2    
Version: WebKit Nightly Build   
Hardware: All   
OS: All   
Attachments:
Description Flags
the patch saam: review+

Filip Pizlo
Reported 2016-06-28 14:00:04 PDT
According to my experiments this change costs nothing. That's not surprising since the most common way to construct a rope these days is inlined into the JIT, which does its own safety checks. This makes us crash sooner rather than corrupting memory.
Attachments
the patch (2.12 KB, patch)
2016-06-28 14:01 PDT, Filip Pizlo 		saam: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2016-06-28 14:01:08 PDT
Created attachment 282282 [details] the patch
Filip Pizlo
Comment 2 2016-06-28 14:04:04 PDT
Landed in https://trac.webkit.org/changeset/202585
Note You need to log in before you can comment on or make changes to this bug.