141168 2015-02-02 12:35:34 -0800 Memory is written to after deallocated, in GraphicsLayer::setMaskLayer. 2015-02-02 13:39:13 -0800 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 peavo webkit-unassigned alex.christensen bfulgham commit-queue esprehn+autocc glenn kondapallykalyan simon.fraser oldest_to_newest 1066191 0 peavo 2015-02-02 12:35:34 -0800 Visual Studio detected that a deallocated heap block had been modified in GraphicsLayer::setMaskLayer, when called from RenderLayerBacking::updateChildClippingStrategy. void GraphicsLayer::setMaskLayer(GraphicsLayer* layer) { if (layer == m_maskLayer) return; if (layer) { layer->removeFromParent(); layer->setParent(this); layer->setIsMaskLayer(true); } else if (m_maskLayer) { m_maskLayer->setParent(nullptr); <--------------- Writing to deallocated memory m_maskLayer->setIsMaskLayer(false); <--------------- } m_maskLayer = layer; } 1066194 1 245894 peavo 2015-02-02 12:40:43 -0800 Created attachment 245894 Patch 1066200 2 245894 bfulgham 2015-02-02 12:56:21 -0800 Comment on attachment 245894 Patch Wow! That's not good! :-) I guess this happens if the m_childClippingMaskLayer is also part of the layer hierarchy and is therefore accessed for a "setMaskLayer" update? This might only happen in the WinCairo implementation due to its use of the texture mapping stuff to handle accelerated compositing. r=me. 1066204 3 peavo 2015-02-02 13:13:08 -0800 (In reply to comment #2) > Comment on attachment 245894 [details] > Patch > Thanks for reviewing :) > Wow! That's not good! :-) > > I guess this happens if the m_childClippingMaskLayer is also part of the > layer hierarchy and is therefore accessed for a "setMaskLayer" update? > > This might only happen in the WinCairo implementation due to its use of the > texture mapping stuff to handle accelerated compositing. > Good point, could be a bug only on WinCairo. Also, it was not really harmful, since the overwrite happened just after deallocation, and nobody had reallocated the block, yet ... :) > r=me. 1066208 4 245894 commit-queue 2015-02-02 13:39:09 -0800 Comment on attachment 245894 Patch Clearing flags on attachment: 245894 Committed r179495: <http://trac.webkit.org/changeset/179495> 1066209 5 commit-queue 2015-02-02 13:39:13 -0800 All reviewed patches have been landed. Closing bug. 245894 2015-02-02 12:40:43 -0800 2015-02-02 13:39:09 -0800 Patch bug-141168-20150202214046.patch text/plain 1595 peavo SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE3OTQ4NykKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBACisyMDE1LTAyLTAyICBwZWF2b0Bv dXRsb29rLmNvbSAgPHBlYXZvQG91dGxvb2suY29tPgorCisgICAgICAgIE1lbW9yeSBpcyB3cml0 dGVuIHRvIGFmdGVyIGRlYWxsb2NhdGVkLCBpbiBHcmFwaGljc0xheWVyOjpzZXRNYXNrTGF5ZXIu CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNDExNjgK KworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBWaXN1YWwg U3R1ZGlvIGRldGVjdGVkIHRoYXQgYSBkZWFsbG9jYXRlZCBoZWFwIGJsb2NrIGhhZCBiZWVuIG1v ZGlmaWVkIGluIEdyYXBoaWNzTGF5ZXI6OnNldE1hc2tMYXllciwKKyAgICAgICAgd2hlbiBjYWxs ZWQgZnJvbSBSZW5kZXJMYXllckJhY2tpbmc6OnVwZGF0ZUNoaWxkQ2xpcHBpbmdTdHJhdGVneS4K KworICAgICAgICAqIHJlbmRlcmluZy9SZW5kZXJMYXllckJhY2tpbmcuY3BwOgorICAgICAgICAo V2ViQ29yZTo6UmVuZGVyTGF5ZXJCYWNraW5nOjp1cGRhdGVDaGlsZENsaXBwaW5nU3RyYXRlZ3kp OgorCiAyMDE1LTAyLTAyICBCcmVudCBGdWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUuY29tPgogCiAg ICAgICAgIFtXaW5dIEJ1aWxkIGZpeCBhZnRlciByMTc5NDc2LgpJbmRleDogU291cmNlL1dlYkNv cmUvcmVuZGVyaW5nL1JlbmRlckxheWVyQmFja2luZy5jcHAKPT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNl L1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckxheWVyQmFja2luZy5jcHAJKHJldmlzaW9uIDE3OTQ3 MikKKysrIFNvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJMYXllckJhY2tpbmcuY3BwCSh3 b3JraW5nIGNvcHkpCkBAIC0xNDY4LDkgKzE0NjgsOSBAQCB2b2lkIFJlbmRlckxheWVyQmFja2lu Zzo6dXBkYXRlQ2hpbGRDbGlwCiAgICAgICAgIH0KICAgICB9IGVsc2UgewogICAgICAgICBpZiAo bV9jaGlsZENsaXBwaW5nTWFza0xheWVyKSB7Ci0gICAgICAgICAgICBtX2NoaWxkQ2xpcHBpbmdN YXNrTGF5ZXIgPSBudWxscHRyOwogICAgICAgICAgICAgaWYgKGhhc0NsaXBwaW5nTGF5ZXIoKSkK ICAgICAgICAgICAgICAgICBjbGlwcGluZ0xheWVyKCktPnNldE1hc2tMYXllcihudWxscHRyKTsK KyAgICAgICAgICAgIG1fY2hpbGRDbGlwcGluZ01hc2tMYXllciA9IG51bGxwdHI7CiAgICAgICAg IH0gZWxzZSAKICAgICAgICAgICAgIGlmIChoYXNDbGlwcGluZ0xheWVyKCkpCiAgICAgICAgICAg ICAgICAgY2xpcHBpbmdMYXllcigpLT5zZXRNYXNrc1RvQm91bmRzUmVjdChGbG9hdFJvdW5kZWRS ZWN0KEZsb2F0UmVjdChGbG9hdFBvaW50KCksIGNsaXBwaW5nTGF5ZXIoKS0+c2l6ZSgpKSkpOwo=