Bug 212601

Summary:

[JSC] JSBigInt::rightTrim can miss |this| pointer and leads to incorrect GC collection

Product:

WebKit

Reporter:

Yusuke Suzuki <ysuzuki>

Component:

New Bugs

Assignee:

Yusuke Suzuki <ysuzuki>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

ews-watchlist, keith_miller, mark.lam, msaboff, saam, tzagallo, webkit-bug-importer

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Patch	none

Description Yusuke Suzuki 2020-06-01 10:49:55 PDT

[JSC] JSBigInt::rightTrim can miss |this| pointer and leads to incorrect GC collection

Comment 1 Yusuke Suzuki 2020-06-01 10:51:22 PDT

Created attachment 400740 [details]
Patch

Comment 2 Yusuke Suzuki 2020-06-01 10:51:50 PDT

<rdar://problem/63830021>

Comment 3 EWS 2020-06-01 13:27:16 PDT

Committed r262392: <https://trac.webkit.org/changeset/262392>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 400740 [details].