Bug 172556

Summary: Vector::grow() will loop indefinitely and cause memory access violation if the new size is less than the current size
Product: WebKit Reporter: Said Abou-Hallawa <sabouhallawa>
Component: New BugsAssignee: Nobody <webkit-unassigned>
Status: NEW ---    
Severity: Normal CC: ap, bfulgham, ggaren, jer.noble, jonlee, simon.fraser
Priority: P2    
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=172552

Description Said Abou-Hallawa 2017-05-24 15:02:39 PDT 
Similar issue will happen with Vector::shrink() if the new size is larger than the current size.
Comment 1 Alexey Proskuryakov 2017-05-27 00:08:08 PDT 
There is already an assertion to guard against this. This doesn't seem like something that needs fixing to me.