[Webkit-unassigned] [Bug 14771] Unbounded memory growth in KJS::UString when repeatedly slicing and prepending/appending

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=14771


mjs at apple.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #15834|review?(mjs at apple.com)      |review-
               Flag|                            |




------- Comment #14 from mjs at apple.com  2007-09-09 20:33 PDT -------
(From update of attachment 15834)
I'd like to take this fix, but I think two issues need addressing:

1) The conditions to check whether append or prepend is allowed should be
factored out into some separate inline functions with good clear names. They
are getting complicated enough that it's hard to tell what the actual condition
is.

2) There are other code paths that do similar checks for append, which I think
should be given the same treatment. Let's update all of them at once. In
particular, the three versions of UString::append should be updated.

3) It would be nice to include a test case that would show the unbounded memory
growth without this fix.

Thanks for the fix! I'm looking forward to the updated version.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.