[Webkit-unassigned] [Bug 187947] JavaScript string corruption using RegExp with unicode character

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=187947

Sukolsak Sakshuwong <sukolsak at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sukolsak at gmail.com

--- Comment #2 from Sukolsak Sakshuwong <sukolsak at gmail.com> ---
The code from the snippet above causes an assertion failure in Debug mode:

ASSERTION FAILED: is8Bit()
/webkit/WebKitBuild/Debug/usr/local/include/wtf/text/StringImpl.h(271) : const LChar *WTF::StringImpl::characters8() const
1   0x10c34a419 WTFCrash
2   0x10c34dd19 WTF::StringImpl::characters8() const
3   0x10d6976f4 JSC::JSRopeString::resolveRopeInternal8NoSubstring(unsigned char*) const
4   0x10d69758a JSC::JSRopeString::resolveRopeInternal8(unsigned char*) const
5   0x10d698c82 JSC::JSRopeString::resolveRopeToExistingAtomicString(JSC::ExecState*) const
6   0x10cc9436c JSC::JSString::toExistingAtomicString(JSC::ExecState*) const
7   0x10d36f12f JSC::LLInt::getByVal(JSC::VM&, JSC::ExecState*, JSC::Instruction*, JSC::JSValue, JSC::JSValue)
8   0x10d36eeb5 llint_slow_path_get_by_val
9   0x10c439862 llint_entry
10  0x10c4355b2 vmEntryToJavaScript
11  0x10d28b50a JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
12  0x10d28aab1 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*)
13  0x10d543ad7 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
14  0x10c285010 runWithOptions(GlobalObject*, CommandLine&, bool&)
15  0x10c25c9cc jscmain(int, char**)::$_3::operator()(JSC::VM&, GlobalObject*, bool&) const
16  0x10c244174 int runJSC<jscmain(int, char**)::$_3>(CommandLine, bool, jscmain(int, char**)::$_3 const&)
17  0x10c242c5f jscmain(int, char**)
18  0x10c242bbe main
19  0x7fff6dff4015 start
Segmentation fault: 11

Here is a smaller script that reproduces the same bug:

    var ab16bit = 'abcĀ'.replace(/c.*/, '');

    var map = {};
    map[ab16bit];

    var ropeAB = 'a' + 'b';
    var ropeABC = ropeAB + 'c';

    map[ropeAB];
    map[ropeABC] = 42;
    console.log(JSON.stringify(map)); // Expected: {"abc":42}. Actual: {"a\u0000c":42}.

"map[ab16bit]" creates a 16-bit AtomicString "ab". ropeAB and ropeABC are initially 8-bit JSRopeStrings. "map[ropeAB]" causes ropeAB to resolve into the 16-bit AtomicString "ab". Because of https://webkit.org/b/133574, ropeAB becomes a 16-bit string. However, ropeABC, which points to ropeAB, is still an 8-bit JSRopeString. So, when it is forced to resolve, it copies only the first two bytes of ropeAB, which is "a\0". Thus it returns "a\0c".

One way to fix this seems to be that, when an 8-bit JSRopeString becomes 16-bit, it should set all its ancestor JSRopeStrings to be 16-bit. But I'm not sure how.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180727/f86d8b91/attachment.html>