TemplateObjectDescriptor constructor calculates m_hash on use-after-move variable: inline TemplateObjectDescriptor::TemplateObjectDescriptor(StringVector&& rawStrings, OptionalStringVector&& cookedStrings) : m_rawStrings(WTFMove(rawStrings)) , m_cookedStrings(WTFMove(cookedStrings)) , m_hash(calculateHash(rawStrings)) { } It should probably use m_rawstrings instead.
Regressed in r208953: Bug 164898: Crash in com.apple.JavaScriptCore: WTF::ThreadSpecific<WTF::WTFThreadData, + 142 <https://bugs.webkit.org/show_bug.cgi?id=164898> <https://trac.webkit.org/changeset/208953/webkit>
Oops!
Created attachment 346593 [details] Patch v1 Not sure how to write a test for this.
<rdar://problem/42935448>
(In reply to David Kilzer (:ddkilzer) from comment #3) > Created attachment 346593 [details] > Patch v1 > > Not sure how to write a test for this. Also not sure of the user visible effect. Just poor performance when looking up items in the hash?
Comment on attachment 346593 [details] Patch v1 r=me
<rdar://problem/42882339>
(In reply to David Kilzer (:ddkilzer) from comment #5) > (In reply to David Kilzer (:ddkilzer) from comment #3) > > Created attachment 346593 [details] > > Patch v1 > > > > Not sure how to write a test for this. > > Also not sure of the user visible effect. Just poor performance when > looking up items in the hash? I think so. Calculating a hash on empty vector (moved).
Comment on attachment 346593 [details] Patch v1 Clearing flags on attachment: 346593 Committed r234580: <https://trac.webkit.org/changeset/234580>
All reviewed patches have been landed. Closing bug.