Summary: | Crash in JSC::Lexer<unsigned char>::setCode | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | june901116 | ||||||||||
Component: | JavaScriptCore | Assignee: | Saam Barati <saam> | ||||||||||
Status: | RESOLVED FIXED | ||||||||||||
Severity: | Normal | CC: | bugs-noreply, buildbot, cedric.bellegarde, cgarcia, clopez, commit-queue, ggaren, june901116, keith_miller, mark.lam, mcatanzaro, msaboff, saam, ysuzuki | ||||||||||
Priority: | P2 | ||||||||||||
Version: | Other | ||||||||||||
Hardware: | Unspecified | ||||||||||||
OS: | Linux | ||||||||||||
Attachments: |
|
Created attachment 312163 [details]
gdb backtrace
*** Bug 173539 has been marked as a duplicate of this bug. *** Crash reproducible also with trunk (r218482) but the backtrace looks different Created attachment 313276 [details] GDB backtrace when running jsc (r218481) over the PoC Same with 2.16.4 Looks like this line of code: m_buffer16.reserveInitialCapacity((m_codeEnd - m_code) / 2); Not sure why we're reserving this much memory. This change was done in r59061, so a long time ago. Created attachment 313851 [details]
patch
Comment on attachment 313851 [details]
patch
r=me
Comment on attachment 313851 [details] patch Clearing flags on attachment: 313851 Committed r218819: <http://trac.webkit.org/changeset/218819> All reviewed patches have been landed. Closing bug. |
Created attachment 311595 [details] PoC How to reproduce? 1. Run JavaScriptCore in Webgtk2.16.3 releases with Poc. $ ./jsc reproduce.js