[Webkit-unassigned] [Bug 144257] REGRESSION (r183373): ASSERT failed in wtf/SHA1.h

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=144257

--- Comment #1 from Yusuke Suzuki <utatane.tea at gmail.com> ---
OK. I've found the issue.
SHA1 is used to calculate CodeBlockHash.
To calculate hash value, we pass the source code UTF-8 string to SHA1::addBytes.
However, in SHA1::addBytes, there's assertion `input.length() == strlen(string)`.

In the template-literal-syntax.js, we perform `eval` with the script contains "\0". As the result, `strlen(string)` accidentally shortened by the contained "\0", and assertion fails.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150427/a13796a0/attachment.html>