<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>127285</bug_id>
          
          <creation_ts>2014-01-20 04:45:49 -0800</creation_ts>
          <short_desc>Improve security mitigation added in webkit r94001. We missed the case where attachLine was called when we already had an inline box wrapper.</short_desc>
          <delta_ts>2016-07-14 10:23:47 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>WebCore Misc.</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>BlinkMergeCandidate, InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Peter Molnar">pmolnar.u-szeged</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>commit-queue</cc>
    
    <cc>esprehn+autocc</cc>
    
    <cc>glenn</cc>
    
    <cc>hyatt</cc>
    
    <cc>koivisto</cc>
    
    <cc>kondapallykalyan</cc>
    
    <cc>rniwa</cc>
    
    <cc>simon.fraser</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>969809</commentid>
    <comment_count>0</comment_count>
    <who name="Peter Molnar">pmolnar.u-szeged</who>
    <bug_when>2014-01-20 04:45:49 -0800</bug_when>
    <thetext>Merged from blink: https://src.chromium.org/viewvc/blink?revision=150697&amp;view=revision</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>969810</commentid>
    <comment_count>1</comment_count>
      <attachid>221647</attachid>
    <who name="Peter Molnar">pmolnar.u-szeged</who>
    <bug_when>2014-01-20 04:49:26 -0800</bug_when>
    <thetext>Created attachment 221647
patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1001330</commentid>
    <comment_count>2</comment_count>
      <attachid>221647</attachid>
    <who name="Brent Fulgham">bfulgham</who>
    <bug_when>2014-04-16 14:19:51 -0700</bug_when>
    <thetext>Comment on attachment 221647
patch

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1001343</commentid>
    <comment_count>3</comment_count>
      <attachid>221647</attachid>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2014-04-16 14:51:24 -0700</bug_when>
    <thetext>Comment on attachment 221647
patch

Clearing flags on attachment: 221647

Committed r167387: &lt;http://trac.webkit.org/changeset/167387&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1001344</commentid>
    <comment_count>4</comment_count>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2014-04-16 14:51:28 -0700</bug_when>
    <thetext>All reviewed patches have been landed.  Closing bug.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1001390</commentid>
    <comment_count>5</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2014-04-16 16:43:31 -0700</bug_when>
    <thetext>&lt;rdar://problem/16641230&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1211034</commentid>
    <comment_count>6</comment_count>
    <who name="Brent Fulgham">bfulgham</who>
    <bug_when>2016-07-14 10:23:47 -0700</bug_when>
    <thetext>*** Bug 116911 has been marked as a duplicate of this bug. ***</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>221647</attachid>
            <date>2014-01-20 04:49:26 -0800</date>
            <delta_ts>2014-04-16 14:51:24 -0700</delta_ts>
            <desc>patch</desc>
            <filename>renderbox-blink.patch</filename>
            <type>text/plain</type>
            <size>3130</size>
            <attacher name="Peter Molnar">pmolnar.u-szeged</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0No
YW5nZUxvZwppbmRleCA1ZmRlODFlLi41N2FkNTk3IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29y
ZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTgg
QEAKKzIwMTQtMDEtMjAgIFBldGVyIE1vbG5hciAgPHBtb2xuYXIudS1zemVnZWRAcGFydG5lci5z
YW1zdW5nLmNvbT4KKworICAgICAgICBJbXByb3ZlIHNlY3VyaXR5IG1pdGlnYXRpb24gYWRkZWQg
aW4gd2Via2l0IHI5NDAwMS4KKyAgICAgICAgV2UgbWlzc2VkIHRoZSBjYXNlIHdoZXJlIGF0dGFj
aExpbmUgd2FzIGNhbGxlZCB3aGVuIHdlIGFscmVhZHkgaGFkIGFuIGlubGluZSBib3ggd3JhcHBl
ci4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEyNzI4
NQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIE1lcmdl
ZCBmcm9tIEJsaW5rOiBodHRwczovL3NyYy5jaHJvbWl1bS5vcmcvdmlld3ZjL2JsaW5rP3Jldmlz
aW9uPTE1MDY5NyZ2aWV3PXJldmlzaW9uCisKKyAgICAgICAgKiByZW5kZXJpbmcvUmVuZGVyQm94
LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlJlbmRlckJveDo6cG9zaXRpb25MaW5lQm94KToKKyAg
ICAgICAgKiByZW5kZXJpbmcvUmVuZGVyQm94Lmg6CisgICAgICAgIChXZWJDb3JlOjpSZW5kZXJC
b3g6OnNldElubGluZUJveFdyYXBwZXIpOgorCiAyMDE0LTAxLTIwICBNb3J0ZW4gU3RlbnNob3Ju
ZSAgPG1zdGVuc2hvQG9wZXJhLmNvbT4KIAogICAgICAgICBSZWdpb24gYmFzZWQgbXVsdGljb2w6
IHRhbGwgbGluZSBjYXVzZXMgdGFsbGVyIG11bHRpY29sIGNvbnRhaW5lciB0aGFuIG5lY2Vzc2Fy
eQpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckJveC5jcHAgYi9T
b3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyQm94LmNwcAppbmRleCAzY2MwNWM1Li45N2Yz
NDU5IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyQm94LmNwcAor
KysgYi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyQm94LmNwcApAQCAtMjAyNCwxMSAr
MjAyNCw3IEBAIHZvaWQgUmVuZGVyQm94Ojpwb3NpdGlvbkxpbmVCb3goSW5saW5lRWxlbWVudEJv
eCYgYm94KQogCiAgICAgaWYgKGlzUmVwbGFjZWQoKSkgewogICAgICAgICBzZXRMb2NhdGlvbihy
b3VuZGVkTGF5b3V0UG9pbnQoYm94LnRvcExlZnQoKSkpOwotICAgICAgICAvLyBtX2lubGluZUJv
eFdyYXBwZXIgc2hvdWxkIGFscmVhZHkgYmUgMC4gRGVsZXRpbmcgaXQgaXMgYSBzYWZlZ3VhcmQg
YWdhaW5zdCBzZWN1cml0eSBpc3N1ZXMuCi0gICAgICAgIEFTU0VSVCghbV9pbmxpbmVCb3hXcmFw
cGVyKTsKLSAgICAgICAgaWYgKG1faW5saW5lQm94V3JhcHBlcikKLSAgICAgICAgICAgIGRlbGV0
ZUxpbmVCb3hXcmFwcGVyKCk7Ci0gICAgICAgIG1faW5saW5lQm94V3JhcHBlciA9ICZib3g7Cisg
ICAgICAgIHNldElubGluZUJveFdyYXBwZXIoJmJveCk7CiAgICAgfQogfQogCmRpZmYgLS1naXQg
YS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyQm94LmggYi9Tb3VyY2UvV2ViQ29yZS9y
ZW5kZXJpbmcvUmVuZGVyQm94LmgKaW5kZXggYzA4OTg5Ni4uZTk4OGY2MCAxMDA2NDQKLS0tIGEv
U291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckJveC5oCisrKyBiL1NvdXJjZS9XZWJDb3Jl
L3JlbmRlcmluZy9SZW5kZXJCb3guaApAQCAtMzgzLDcgKzM4Myw3IEBAIHB1YmxpYzoKICAgICAv
LyB0aGUgcmVwbGFjZWQgUmVuZGVyT2JqZWN0IHRvIHF1aWNrbHkgZGV0ZXJtaW5lIHdoYXQgbGlu
ZSBpdCBpcyBjb250YWluZWQgb24gYW5kIHRvIGVhc2lseQogICAgIC8vIGl0ZXJhdGUgb3ZlciBz
dHJ1Y3R1cmVzIG9uIHRoZSBsaW5lLgogICAgIElubGluZUVsZW1lbnRCb3gqIGlubGluZUJveFdy
YXBwZXIoKSBjb25zdCB7IHJldHVybiBtX2lubGluZUJveFdyYXBwZXI7IH0KLSAgICB2b2lkIHNl
dElubGluZUJveFdyYXBwZXIoSW5saW5lRWxlbWVudEJveCogYm94V3JhcHBlcikgeyBtX2lubGlu
ZUJveFdyYXBwZXIgPSBib3hXcmFwcGVyOyB9CisgICAgdm9pZCBzZXRJbmxpbmVCb3hXcmFwcGVy
KElubGluZUVsZW1lbnRCb3gqKTsKICAgICB2b2lkIGRlbGV0ZUxpbmVCb3hXcmFwcGVyKCk7CiAK
ICAgICB2aXJ0dWFsIExheW91dFJlY3QgY2xpcHBlZE92ZXJmbG93UmVjdEZvclJlcGFpbnQoY29u
c3QgUmVuZGVyTGF5ZXJNb2RlbE9iamVjdCogcmVwYWludENvbnRhaW5lcikgY29uc3Qgb3ZlcnJp
ZGU7CkBAIC03NDYsNiArNzQ2LDIxIEBAIGlubGluZSBSZW5kZXJCb3gqIFJlbmRlckJveDo6bGFz
dENoaWxkQm94KCkgY29uc3QKICAgICByZXR1cm4gdG9SZW5kZXJCb3gobGFzdENoaWxkKCkpOwog
fQogCitpbmxpbmUgdm9pZCBSZW5kZXJCb3g6OnNldElubGluZUJveFdyYXBwZXIoSW5saW5lRWxl
bWVudEJveCogYm94V3JhcHBlcikKK3sKKyAgICBpZiAoYm94V3JhcHBlcikgeworICAgICAgICBB
U1NFUlQoIW1faW5saW5lQm94V3JhcHBlcik7CisgICAgICAgIC8vIG1faW5saW5lQm94V3JhcHBl
ciBzaG91bGQgYWxyZWFkeSBiZSAwLiBEZWxldGluZyBpdCBpcyBhIHNhZmVndWFyZCBhZ2FpbnN0
IHNlY3VyaXR5IGlzc3Vlcy4KKyAgICAgICAgLy8gT3RoZXJ3aXNlLCB0aGVyZSB3aWxsIHR3byBs
aW5lIGJveCB3cmFwcGVycyBrZWVwaW5nIHRoZSByZWZlcmVuY2UgdG8gdGhpcyByZW5kZXJlciwg
YW5kCisgICAgICAgIC8vIG9ubHkgb25lIHdpbGwgYmUgbm90aWZpZWQgd2hlbiB0aGUgcmVuZGVy
ZXIgaXMgZ2V0dGluZyBkZXN0cm95ZWQuIFRoZSBzZWNvbmQgbGluZSBib3ggd3JhcHBlcgorICAg
ICAgICAvLyB3aWxsIGtlZXAgYSBzdGFsZSByZWZlcmVuY2UuCisgICAgICAgIGlmIChVTkxJS0VM
WShtX2lubGluZUJveFdyYXBwZXIgIT0gMCkpCisgICAgICAgICAgICBkZWxldGVMaW5lQm94V3Jh
cHBlcigpOworICAgIH0KKworICAgIG1faW5saW5lQm94V3JhcHBlciA9IGJveFdyYXBwZXI7Cit9
CisKIH0gLy8gbmFtZXNwYWNlIFdlYkNvcmUKIAogI2VuZGlmIC8vIFJlbmRlckJveF9oCg==
</data>

          </attachment>
      

    </bug>

</bugzilla>