Bug 150943 - Layout Test js/intl-collator.html is crashing on win 7 debug
Summary: Layout Test js/intl-collator.html is crashing on win 7 debug
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Sukolsak Sakshuwong
Depends on:
Reported: 2015-11-05 13:57 PST by Ryan Haddad
Modified: 2015-11-05 21:53 PST (History)
5 users (show)

See Also:

Patch (3.62 KB, patch)
2015-11-05 19:59 PST, Sukolsak Sakshuwong
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Ryan Haddad 2015-11-05 14:02:14 PST
Marked as a crash on win debug in <https://trac.webkit.org/r192074>
Comment 2 Sukolsak Sakshuwong 2015-11-05 19:34:54 PST
From the error log (https://build.webkit.org/results/Apple%20Win%207%20Debug%20(Tests)/r192057%20(68184)/js/intl-collator-crash-log.txt), this seems to cause the crash:

05 002dc548 5ab475d9 WTF!WTF::String::String(char * characters = 0x00524c98 "standard", unsigned int length = 0xcccccccc)+0x36 [c:\cygwin\home\buildbot\slave\win-debug\build\source\wtf\wtf\text\wtfstring.cpp @ 69]
06 002dc5d0 5ab523ff JavaScriptCore!JSC::sortLocaleData(class WTF::String * locale = 0x002dc7a0, class WTF::String * key = 0x065f9978)+0xf9 [c:\cygwin\home\buildbot\slave\win-debug\build\source\javascriptcore\runtime\intlcollatorconstructor.cpp @ 78]

These are lines 76 - 78 of runtime/IntlCollatorConstructor.cpp:

    int32_t length;
    while ((keywordValue = uenum_next(enumeration, &length, &status)) && U_SUCCESS(status)) {
        String collation(keywordValue, length);

It seems that uenum_next() returned a string "standard" but incorrectly set the length to 0xcccccccc or probably didn't set the length at all. This looks like a bug in an old version of ICU. I tried to find it in the ICU repo but couldn't.

uenum_next() returns a null-terminated string anyway. We don't need to use the length.
Comment 3 Sukolsak Sakshuwong 2015-11-05 19:59:32 PST
Created attachment 264915 [details]
Comment 4 Geoffrey Garen 2015-11-05 20:14:22 PST
Comment on attachment 264915 [details]

Comment 5 WebKit Commit Bot 2015-11-05 21:53:36 PST
Comment on attachment 264915 [details]

Clearing flags on attachment: 264915

Committed r192092: <http://trac.webkit.org/changeset/192092>
Comment 6 WebKit Commit Bot 2015-11-05 21:53:40 PST
All reviewed patches have been landed.  Closing bug.