Summary: | [JSC] Substring resolving should check 8bit / 16bit again | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Lukas Bernhard <lukas.bernhard> | ||||||
Component: | JavaScriptCore | Assignee: | Yusuke Suzuki <ysuzuki> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | CC: | bfulgham, ews-watchlist, keith_miller, mark.lam, msaboff, saam, tzagallo, webkit-bug-importer, ysuzuki | ||||||
Priority: | P2 | Keywords: | InRadar | ||||||
Version: | WebKit Local Build | ||||||||
Hardware: | Unspecified | ||||||||
OS: | Unspecified | ||||||||
Attachments: |
|
Description
Lukas Bernhard
2022-02-17 05:44:57 PST
Created attachment 456800 [details]
Patch
Created attachment 456802 [details]
Patch
Comment on attachment 456802 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=456802&action=review > Source/JavaScriptCore/ChangeLog:10 > + Substring JSString is wrapping JSString. Thus it is possible that underlying JSString's 8Bit / 16Bit status > + becomes different from substring JSString wrapper's bit. We should not assume they are the same. Why does the underlying string change here? Comment on attachment 456802 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=456802&action=review >> Source/JavaScriptCore/ChangeLog:10 >> + becomes different from substring JSString wrapper's bit. We should not assume they are the same. > > Why does the underlying string change here? One possible case is that, underlying string was 16bit rope, and after resolving that, it was converted into the existing 8bit atom string. Committed r292484 (249335@trunk): <https://commits.webkit.org/249335@trunk> This fix shipped with Safari 15.5 (all platforms). |