124191 2013-11-11 23:42:53 -0800 Remote Layer Tree: Sporadic memory corruption during painting 2013-11-11 23:55:08 -0800 1 1 1 Unclassified WebKit WebKit2 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 thorton thorton oldest_to_newest 949579 0 thorton 2013-11-11 23:42:53 -0800 I half-flipped the logic of a condition but failed to flip the operators, causing us to overrun the bounds of cgPaintingRects. 949580 1 216642 thorton 2013-11-11 23:44:27 -0800 Created attachment 216642 patch 949581 2 216643 thorton 2013-11-11 23:48:10 -0800 Created attachment 216643 clarify changelog 949584 3 thorton 2013-11-11 23:55:08 -0800 http://trac.webkit.org/changeset/159098 216642 2013-11-11 23:44:27 -0800 2013-11-11 23:48:10 -0800 patch crash.diff text/plain 1798 thorton ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQyL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQyL0No YW5nZUxvZwppbmRleCA4MjgyOGQ0Li5kODg3NGM5IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViS2l0 Mi9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYktpdDIvQ2hhbmdlTG9nCkBAIC0xLDUgKzEsMTgg QEAKIDIwMTMtMTEtMTEgIFRpbSBIb3J0b24gIDx0aW1vdGh5X2hvcnRvbkBhcHBsZS5jb20+CiAK KyAgICAgICAgUmVtb3RlIExheWVyIFRyZWU6IFNwb3JhZGljIGNvcnJ1cHRpb24gZHVyaW5nIHBh aW50aW5nCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0x MjQxOTEKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBG aXggYSBsb2dpYyBlcnJvciBtYWRlIGluIHRoZSBsYXN0IHZlcnNpb24gb2YgcjE1ODk4MiB0aGF0 IGNhdXNlZAorICAgICAgICBzb21lIGNyYXNoZXMgYmVjYXVzZSBpdCBhbGxvd2VkIHVzIHRvIG92 ZXJydW4gdGhlIGVuZCBvZiBjZ1BhaW50aW5nUmVjdHMuCisKKyAgICAgICAgKiBTaGFyZWQvbWFj L1JlbW90ZUxheWVyQmFja2luZ1N0b3JlLm1tOgorICAgICAgICAoUmVtb3RlTGF5ZXJCYWNraW5n U3RvcmU6OmRyYXdJbkNvbnRleHQpOgorCisyMDEzLTExLTExICBUaW0gSG9ydG9uICA8dGltb3Ro eV9ob3J0b25AYXBwbGUuY29tPgorCiAgICAgICAgIFJlbW90ZSBMYXllciBUcmVlOiBJbXBsZW1l bnQgUGFnZSBPdmVybGF5cwogICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1 Zy5jZ2k/aWQ9MTI0MTY1CiAgICAgICAgIDxyZGFyOi8vcHJvYmxlbS8xNTE5OTA1Nj4KZGlmZiAt LWdpdCBhL1NvdXJjZS9XZWJLaXQyL1NoYXJlZC9tYWMvUmVtb3RlTGF5ZXJCYWNraW5nU3RvcmUu bW0gYi9Tb3VyY2UvV2ViS2l0Mi9TaGFyZWQvbWFjL1JlbW90ZUxheWVyQmFja2luZ1N0b3JlLm1t CmluZGV4IGI1NTExMGYuLmMxODY2MzUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQyL1NoYXJl ZC9tYWMvUmVtb3RlTGF5ZXJCYWNraW5nU3RvcmUubW0KKysrIGIvU291cmNlL1dlYktpdDIvU2hh cmVkL21hYy9SZW1vdGVMYXllckJhY2tpbmdTdG9yZS5tbQpAQCAtMjQzLDcgKzI0Myw3IEBAIHZv aWQgUmVtb3RlTGF5ZXJCYWNraW5nU3RvcmU6OmRyYXdJbkNvbnRleHQoR3JhcGhpY3NDb250ZXh0 JiBjb250ZXh0LCBDR0ltYWdlUmVmCiAgICAgLy8gT3RoZXJ3aXNlLCByZXBhaW50IHRoZSBlbnRp cmUgYm91bmRpbmcgYm94IG9mIHRoZSBkaXJ0eSByZWdpb24uCiAgICAgSW50UmVjdCBkaXJ0eUJv dW5kcyA9IG1fZGlydHlSZWdpb24uYm91bmRzKCk7CiAgICAgVmVjdG9yPEludFJlY3Q+IGRpcnR5 UmVjdHMgPSBtX2RpcnR5UmVnaW9uLnJlY3RzKCk7Ci0gICAgaWYgKGRpcnR5UmVjdHMuc2l6ZSgp ID4gd2ViTGF5ZXJNYXhSZWN0c1RvUGFpbnQgJiYgbV9kaXJ0eVJlZ2lvbi50b3RhbEFyZWEoKSA+ IHdlYkxheWVyV2FzdGVkU3BhY2VUaHJlc2hvbGQgKiBkaXJ0eUJvdW5kcy53aWR0aCgpICogZGly dHlCb3VuZHMuaGVpZ2h0KCkpIHsKKyAgICBpZiAoZGlydHlSZWN0cy5zaXplKCkgPiB3ZWJMYXll ck1heFJlY3RzVG9QYWludCB8fCBtX2RpcnR5UmVnaW9uLnRvdGFsQXJlYSgpID4gd2ViTGF5ZXJX YXN0ZWRTcGFjZVRocmVzaG9sZCAqIGRpcnR5Qm91bmRzLndpZHRoKCkgKiBkaXJ0eUJvdW5kcy5o ZWlnaHQoKSkgewogICAgICAgICBkaXJ0eVJlY3RzLmNsZWFyKCk7CiAgICAgICAgIGRpcnR5UmVj dHMuYXBwZW5kKGRpcnR5Qm91bmRzKTsKICAgICB9Cg== 216643 2013-11-11 23:48:10 -0800 2013-11-11 23:53:05 -0800 clarify changelog crash.diff text/plain 1860 thorton ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQyL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQyL0No YW5nZUxvZwppbmRleCA4MjgyOGQ0Li4yODBjYzAwIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViS2l0 Mi9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYktpdDIvQ2hhbmdlTG9nCkBAIC0xLDUgKzEsMTkg QEAKIDIwMTMtMTEtMTEgIFRpbSBIb3J0b24gIDx0aW1vdGh5X2hvcnRvbkBhcHBsZS5jb20+CiAK KyAgICAgICAgUmVtb3RlIExheWVyIFRyZWU6IFNwb3JhZGljIG1lbW9yeSBjb3JydXB0aW9uIGR1 cmluZyBwYWludGluZworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j Z2k/aWQ9MTI0MTkxCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg ICAgICAgRml4IGEgbG9naWMgZXJyb3IgKGZsaXBwZWQgdGhlIGxvZ2ljLCBkaWRuJ3QgZmxpcCB0 aGUgb3BlcmF0b3IpCisgICAgICAgIG1hZGUgaW4gdGhlIGxhc3QgdmVyc2lvbiBvZiByMTU4OTgy IHRoYXQgY2F1c2VkIHNvbWUgY3Jhc2hlcyBiZWNhdXNlCisgICAgICAgIGl0IGFsbG93ZWQgdXMg dG8gb3ZlcnJ1biB0aGUgZW5kIG9mIGNnUGFpbnRpbmdSZWN0cy4KKworICAgICAgICAqIFNoYXJl ZC9tYWMvUmVtb3RlTGF5ZXJCYWNraW5nU3RvcmUubW06CisgICAgICAgIChSZW1vdGVMYXllckJh Y2tpbmdTdG9yZTo6ZHJhd0luQ29udGV4dCk6CisKKzIwMTMtMTEtMTEgIFRpbSBIb3J0b24gIDx0 aW1vdGh5X2hvcnRvbkBhcHBsZS5jb20+CisKICAgICAgICAgUmVtb3RlIExheWVyIFRyZWU6IElt cGxlbWVudCBQYWdlIE92ZXJsYXlzCiAgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3No b3dfYnVnLmNnaT9pZD0xMjQxNjUKICAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzE1MTk5MDU2Pgpk aWZmIC0tZ2l0IGEvU291cmNlL1dlYktpdDIvU2hhcmVkL21hYy9SZW1vdGVMYXllckJhY2tpbmdT dG9yZS5tbSBiL1NvdXJjZS9XZWJLaXQyL1NoYXJlZC9tYWMvUmVtb3RlTGF5ZXJCYWNraW5nU3Rv cmUubW0KaW5kZXggYjU1MTEwZi4uYzE4NjYzNSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdDIv U2hhcmVkL21hYy9SZW1vdGVMYXllckJhY2tpbmdTdG9yZS5tbQorKysgYi9Tb3VyY2UvV2ViS2l0 Mi9TaGFyZWQvbWFjL1JlbW90ZUxheWVyQmFja2luZ1N0b3JlLm1tCkBAIC0yNDMsNyArMjQzLDcg QEAgdm9pZCBSZW1vdGVMYXllckJhY2tpbmdTdG9yZTo6ZHJhd0luQ29udGV4dChHcmFwaGljc0Nv bnRleHQmIGNvbnRleHQsIENHSW1hZ2VSZWYKICAgICAvLyBPdGhlcndpc2UsIHJlcGFpbnQgdGhl IGVudGlyZSBib3VuZGluZyBib3ggb2YgdGhlIGRpcnR5IHJlZ2lvbi4KICAgICBJbnRSZWN0IGRp cnR5Qm91bmRzID0gbV9kaXJ0eVJlZ2lvbi5ib3VuZHMoKTsKICAgICBWZWN0b3I8SW50UmVjdD4g ZGlydHlSZWN0cyA9IG1fZGlydHlSZWdpb24ucmVjdHMoKTsKLSAgICBpZiAoZGlydHlSZWN0cy5z aXplKCkgPiB3ZWJMYXllck1heFJlY3RzVG9QYWludCAmJiBtX2RpcnR5UmVnaW9uLnRvdGFsQXJl YSgpID4gd2ViTGF5ZXJXYXN0ZWRTcGFjZVRocmVzaG9sZCAqIGRpcnR5Qm91bmRzLndpZHRoKCkg KiBkaXJ0eUJvdW5kcy5oZWlnaHQoKSkgeworICAgIGlmIChkaXJ0eVJlY3RzLnNpemUoKSA+IHdl YkxheWVyTWF4UmVjdHNUb1BhaW50IHx8IG1fZGlydHlSZWdpb24udG90YWxBcmVhKCkgPiB3ZWJM YXllcldhc3RlZFNwYWNlVGhyZXNob2xkICogZGlydHlCb3VuZHMud2lkdGgoKSAqIGRpcnR5Qm91 bmRzLmhlaWdodCgpKSB7CiAgICAgICAgIGRpcnR5UmVjdHMuY2xlYXIoKTsKICAgICAgICAgZGly dHlSZWN0cy5hcHBlbmQoZGlydHlCb3VuZHMpOwogICAgIH0K