<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Member call on NULL pointer in JavaScriptCore/dfg/DFGAbstractInterpretterInlines.h"
href="https://bugs.webkit.org/show_bug.cgi?id=160870#c11">Comment # 11</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Member call on NULL pointer in JavaScriptCore/dfg/DFGAbstractInterpretterInlines.h"
href="https://bugs.webkit.org/show_bug.cgi?id=160870">bug 160870</a>
from <span class="vcard"><a class="email" href="mailto:sbarati@apple.com" title="Saam Barati <sbarati@apple.com>"> <span class="fn">Saam Barati</span></a>
</span></b>
<pre>(In reply to <a href="show_bug.cgi?id=160870#c9">comment #9</a>)
<span class="quote">> A quick update on Daren's request: This is going to be a very difficult
> change to test. The most obvious way would be to integrate undefined
> behavior sanitizer into our testing infrastructure, although this is many
> months off if it will happen at all.
>
> The other method of testing would be construct a test which would crash
> without this change. While this is likely possible, it's unclear to me what
> such a test would like like. While attempting to construct a test which
> would crash without this change, I discovered that it really only seems to
> be js/regress/simple-regexp-exec-folding.html which exhibits the bug, but
> even this test will not always exhibit this error (most notably, is the
> number of iterations through the loop is decreased, the error will no longer
> occur).</span >
So there is a test where we call this function on a nullptr?
If so, why don't we crash? Does that function not load any fields?
If not, I'm a bit confused as to what your explanation for needing this
check is. I'm not too familiar about which states this particular field can be null in,
but there are other places where we allow for null in a pointer field,
but later access it without a null check because other conditions
being true imply that the field is non-null. (This may or may not
be the case here).
<span class="quote">>
> If uncovering the precise code path which triggers this bug is important, I
> can continue to investigate. However, I don't think continued investigation
> is worthwhile, as an analogous case in forAllTransitiveIncomingValues
> preforms this check.</span ></pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>