[Webkit-unassigned] [Bug 202624] Aborted (core dumped)

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=202624

Gary Kwong <nth10sd at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |nth10sd at gmail.com,
                   |                            |sbarati at apple.com

--- Comment #2 from Gary Kwong <nth10sd at gmail.com> ---
I made some modifications to Robobisect v0.0.1 (available at https://github.com/nth10sd/robobisect) to find out the likely regressor (when the poc started crashing) and likely fix:

=====================
| Robobisect report |
=====================

Likely regressor:

commit 043245b0ed35b36e177dc7f96df8deb6cdbb5465
Author: mcatanzaro </snip>
Date:   Sun Nov 25 18:22:30 2018 +0000

    CRASH() should call abort() except on Darwin and in developer builds
    https://bugs.webkit.org/show_bug.cgi?id=184408

    Reviewed by Daniel Bates.

    </snip>

    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@238478 268f45cc-cd09-0410-ab3c-d52691b4dbfc

=====================

Likely fix:

commit 17b927ea0dedded5de8356b366a60bf70c9bff45
Author: sbarati </snip>
Date:   Mon Sep 16 19:32:39 2019 +0000

    JSObject::putInlineSlow should not ignore "__proto__" for Proxy
    https://bugs.webkit.org/show_bug.cgi?id=200386
    <rdar://problem/53854946>

    Reviewed by Yusuke Suzuki.

    </snip>

    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@249911 268f45cc-cd09-0410-ab3c-d52691b4dbfc

=====================


Saam/Yusuke, is bug 200386 a likely fix for this bug? Or is this possibly a dupe of bug 200386?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200421/e33c57e4/attachment.htm>