Bug 110155 - Structure::flattenDictionaryStructure should compute max offset in a manner that soundly handles the case where the property list becomes empty
Summary: Structure::flattenDictionaryStructure should compute max offset in a manner t...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Filip Pizlo
URL:
Keywords: InRadar
: 110154 (view as bug list)
Depends on:
Blocks:
 
Reported: 2013-02-18 14:48 PST by Filip Pizlo
Modified: 2013-02-18 16:29 PST (History)
9 users (show)

See Also:


Attachments
the patch (7.79 KB, patch)
2013-02-18 14:51 PST, Filip Pizlo
no flags Details | Formatted Diff | Diff
the patch (7.23 KB, patch)
2013-02-18 14:53 PST, Filip Pizlo
mrowe: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2013-02-18 14:48:21 PST
This was a rookie mistake.  It was doing:

for (blah) {
   m_offset = foo // foo's monotonically increase in the loop
}

as a way of computing max offset for all of the properties.  Except what if the loop doesn't execute because there are no properties?  Well, then, you're going to have a bogus m_offset.

The solution is to initialize m_offset at the top of the loop.
Comment 1 Filip Pizlo 2013-02-18 14:48:43 PST
<rdar://problem/13233773>
Comment 2 Filip Pizlo 2013-02-18 14:51:46 PST
Created attachment 188945 [details]
the patch
Comment 3 Filip Pizlo 2013-02-18 14:52:38 PST
Comment on attachment 188945 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=188945&action=review

> Source/WTF/wtf/DataLog.cpp:80
> -        if (!file)
> +        if (!file) {
>              fprintf(stderr, "Warning: Could not open log file %s for writing.\n", actualFilename);
> +            CRASH();
> +        }

Oops, I will back this out.
Comment 4 Filip Pizlo 2013-02-18 14:53:00 PST
Created attachment 188946 [details]
the patch
Comment 5 Filip Pizlo 2013-02-18 15:23:05 PST
Landed in http://trac.webkit.org/changeset/143269
Comment 6 Filip Pizlo 2013-02-18 16:29:35 PST
*** Bug 110154 has been marked as a duplicate of this bug. ***