[webkit-changes] [WebKit/WebKit] 6b554c: IntlDurationFormat's collectElements() should keep...

[Commit Queue]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 6b554c12cc80805d9be86cca40b605ebcee36ae1
      https://github.com/WebKit/WebKit/commit/6b554c12cc80805d9be86cca40b605ebcee36ae1
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2024-10-21 (Mon, 21 Oct 2024)

  Changed paths:
    M Source/JavaScriptCore/runtime/IntlDurationFormat.cpp

  Log Message:
  -----------
  IntlDurationFormat's collectElements() should keep a String alive while accessing it's data.
https://bugs.webkit.org/show_bug.cgi?id=281849
rdar://138308113

Reviewed by Yijia Huang.

collectElements() was grabbing an 8 bit span from a String's backing store without keeping
the String alive.  As a result, the backing store would be freed immediately before the
span is accessed.  This patch stores the String in a variable explicitly to keep alive past
the lifetime of the span.

This issue was detected by running JSTests/stress/intl-durationformat-digital.js with an
ASAN build.

* Source/JavaScriptCore/runtime/IntlDurationFormat.cpp:
(JSC::collectElements):

Canonical link: https://commits.webkit.org/285539@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications