Bug 212601

Summary: [JSC] JSBigInt::rightTrim can miss |this| pointer and leads to incorrect GC collection
Product: WebKit Reporter: Yusuke Suzuki <ysuzuki>
Component: New BugsAssignee: Yusuke Suzuki <ysuzuki>
Status: RESOLVED FIXED    
Severity: Normal CC: ews-watchlist, keith_miller, mark.lam, msaboff, saam, tzagallo, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch none

Yusuke Suzuki
Reported 2020-06-01 10:49:55 PDT
[JSC] JSBigInt::rightTrim can miss |this| pointer and leads to incorrect GC collection
Attachments
Patch (2.80 KB, patch)
2020-06-01 10:51 PDT, Yusuke Suzuki 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Yusuke Suzuki
Comment 1 2020-06-01 10:51:22 PDT
Created attachment 400740 [details] Patch
Yusuke Suzuki
Comment 2 2020-06-01 10:51:50 PDT
<rdar://problem/63830021>
EWS
Comment 3 2020-06-01 13:27:16 PDT
Committed r262392: <https://trac.webkit.org/changeset/262392> All reviewed patches have been landed. Closing bug and clearing flags on attachment 400740 [details].
Note You need to log in before you can comment on or make changes to this bug.