Bug 115188 - 32 Bit: Crash due to RegExpTest nodes not setting result type to Boolean
Summary: 32 Bit: Crash due to RegExpTest nodes not setting result type to Boolean
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Michael Saboff
Keywords: InRadar
Depends on:
Reported: 2013-04-25 10:53 PDT by Michael Saboff
Modified: 2013-04-25 15:09 PDT (History)
0 users

See Also:

Patch (1.32 KB, patch)
2013-04-25 11:08 PDT, Michael Saboff
ggaren: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Saboff 2013-04-25 10:53:42 PDT
When a RegExp.test() call is made and the result is spilled prior to a consuming Branch, the Branch will fill the the tag and payload, but the spill only stored the payload.  Therefore we end up with garbage in the tag register.
Comment 1 Michael Saboff 2013-04-25 11:08:17 PDT
Created attachment 199690 [details]

Working on test, but can't seem to reduce down to a test that crashes without the fix.  Test will be in subsequent patch.
Comment 2 Geoffrey Garen 2013-04-25 11:15:31 PDT
Comment on attachment 199690 [details]

Comment 3 Geoffrey Garen 2013-04-25 11:22:25 PDT
Comment on attachment 199690 [details]

I think we could test this just by assigning the result of regexp.test() to a local variable, and then asking if the variable is === true, or === false, depending on the regexp. In theory, the CFA will cause garbage to be stored into the tag of the local variable, causing non-boolean-ness with very high probability.
Comment 4 Michael Saboff 2013-04-25 11:34:04 PDT
Committed r149128: <http://trac.webkit.org/changeset/149128>
Comment 5 Michael Saboff 2013-04-25 15:09:20 PDT