[Webkit-unassigned] [Bug 188331] New: REGRESSION (r208953): TemplateObjectDescriptor constructor calculates m_hash on use-after-move variable
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Sat Aug 4 12:22:19 PDT 2018
https://bugs.webkit.org/show_bug.cgi?id=188331
Bug ID: 188331
Summary: REGRESSION (r208953): TemplateObjectDescriptor
constructor calculates m_hash on use-after-move
variable
Product: WebKit
Version: WebKit Nightly Build
Hardware: Unspecified
OS: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: JavaScriptCore
Assignee: webkit-unassigned at lists.webkit.org
Reporter: ddkilzer at webkit.org
CC: utatane.tea at gmail.com
Depends on: 164898
TemplateObjectDescriptor constructor calculates m_hash on use-after-move variable:
inline TemplateObjectDescriptor::TemplateObjectDescriptor(StringVector&& rawStrings, OptionalStringVector&& cookedStrings)
: m_rawStrings(WTFMove(rawStrings))
, m_cookedStrings(WTFMove(cookedStrings))
, m_hash(calculateHash(rawStrings))
{
}
It should probably use m_rawstrings instead.
Referenced Bugs:
https://bugs.webkit.org/show_bug.cgi?id=164898
[Bug 164898] Crash in com.apple.JavaScriptCore: WTF::ThreadSpecific<WTF::WTFThreadData, + 142
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180804/f1080032/attachment.html>
More information about the webkit-unassigned
mailing list