Bug 188331 – REGRESSION (r208953): TemplateObjectDescriptor constructor calculates m_hash on use-after-move variable

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[David Kilzer (:ddkilzer)]

TemplateObjectDescriptor constructor calculates m_hash on use-after-move variable:

inline TemplateObjectDescriptor::TemplateObjectDescriptor(StringVector&& rawStrings, OptionalStringVector&& cookedStrings)
    : m_rawStrings(WTFMove(rawStrings))
    , m_cookedStrings(WTFMove(cookedStrings))
    , m_hash(calculateHash(rawStrings))
{
}

It should probably use m_rawstrings instead.

[David Kilzer (:ddkilzer)]

Regressed in r208953:

Bug 164898: Crash in com.apple.JavaScriptCore: WTF::ThreadSpecific<WTF::WTFThreadData, + 142
​<https://bugs.webkit.org/show_bug.cgi?id=164898>
<https://trac.webkit.org/changeset/208953/webkit>

[Yusuke Suzuki]

Oops!

[David Kilzer (:ddkilzer)]

Created attachment 346593 [details]
Patch v1

Not sure how to write a test for this.

[Radar WebKit Bug Importer]

<rdar://problem/42935448>

[David Kilzer (:ddkilzer)]

(In reply to David Kilzer (:ddkilzer) from comment #3)
> Created attachment 346593 [details]
> Patch v1
> 
> Not sure how to write a test for this.

Also not sure of the user visible effect.  Just poor performance when looking up items in the hash?

[Yusuke Suzuki]

Comment on attachment 346593 [details]
Patch v1

r=me

[David Kilzer (:ddkilzer)]

<rdar://problem/42882339>

[Yusuke Suzuki]

(In reply to David Kilzer (:ddkilzer) from comment #5)
> (In reply to David Kilzer (:ddkilzer) from comment #3)
> > Created attachment 346593 [details]
> > Patch v1
> > 
> > Not sure how to write a test for this.
> 
> Also not sure of the user visible effect.  Just poor performance when
> looking up items in the hash?

I think so. Calculating a hash on empty vector (moved).

[WebKit Commit Bot]

Comment on attachment 346593 [details]
Patch v1

Clearing flags on attachment: 346593

Committed r234580: <https://trac.webkit.org/changeset/234580>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.