141406 2015-02-09 15:24:05 -0800 REGRESSION: tryFastCalloc is no longer "try" 2015-02-10 09:33:48 -0800 1 1 1 Unclassified WebKit Web Template Framework 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED Regression P2 Normal --- 1 ap ap benjamin cmarcelo commit-queue darin ggaren kling oldest_to_newest 1067935 0 ap 2015-02-09 15:24:05 -0800 tryFastCalloc just calls through to fastCalloc, which crashes when allocation fails. 1067938 1 246297 ap 2015-02-09 15:27:16 -0800 Created attachment 246297 proposed fix I saw this cause crashes on fast/canvas/webgl/webgl-compressed-texture-size-limit.html 1067957 2 246297 commit-queue 2015-02-09 16:12:43 -0800 Comment on attachment 246297 proposed fix Clearing flags on attachment: 246297 Committed r179855: <http://trac.webkit.org/changeset/179855> 1067958 3 commit-queue 2015-02-09 16:12:47 -0800 All reviewed patches have been landed. Closing bug. 1068067 4 246297 darin 2015-02-10 08:34:50 -0800 Comment on attachment 246297 proposed fix View in context: https://bugs.webkit.org/attachment.cgi?id=246297&action=review > Source/WTF/wtf/FastMalloc.cpp:326 > + return tryFastZeroedMalloc(numElements * elementSize); Wait a second, what about overflow checking for the multiplication? 1068068 5 darin 2015-02-10 08:36:36 -0800 I think that both fastCalloc and tryFastCalloc are missing checking on overflow in the multiplication in the USE_BMALLOC case. 1068085 6 ap 2015-02-10 09:33:48 -0800 Great catch, I copied the existing code mindlessly. Darin has a fix in bug 141434. 246297 2015-02-09 15:27:16 -0800 2015-02-09 16:12:43 -0800 proposed fix TryMalloc.txt text/plain 1216 ap SW5kZXg6IFNvdXJjZS9XVEYvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XVEYvQ2hh bmdlTG9nCShyZXZpc2lvbiAxNzk4NDcpCisrKyBTb3VyY2UvV1RGL0NoYW5nZUxvZwkod29ya2lu ZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBACisyMDE1LTAyLTA5ICBBbGV4ZXkgUHJvc2t1cnlha292 ICA8YXBAYXBwbGUuY29tPgorCisgICAgICAgIFJFR1JFU1NJT046IHRyeUZhc3RDYWxsb2MgaXMg bm8gbG9uZ2VyICJ0cnkiCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn LmNnaT9pZD0xNDE0MDYKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKwor ICAgICAgICBUaGlzIGNhdXNlcyBjcmFzaGVzIG9uIHNvbWUgV2ViS2l0IHJlZ3Jlc3Npb24gdGVz dCBib3RzLgorCisgICAgICAgICogd3RmL0Zhc3RNYWxsb2MuY3BwOiAoV1RGOjp0cnlGYXN0Q2Fs bG9jKTogRml4IHdoYXQgbG9va3MgbGlrZSBhIGNvcHkvcGFzdGUgbWlzdGFrZS4KKwogMjAxNS0w Mi0wNyAgQ3NhYmEgT3N6dHJvZ29uw6FjICA8b3NzeUB3ZWJraXQub3JnPgogCiAgICAgICAgIFtB Uk1dIEdDIHNvbWV0aW1lcyBzdHVjayBpbiBhbiBpbmZpbml0ZSBsb29wIGlmIHBhcmFsbGVsIEdD IGlzIGVuYWJsZWQKSW5kZXg6IFNvdXJjZS9XVEYvd3RmL0Zhc3RNYWxsb2MuY3BwCj09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT0KLS0tIFNvdXJjZS9XVEYvd3RmL0Zhc3RNYWxsb2MuY3BwCShyZXZpc2lvbiAxNzk3NzYpCisr KyBTb3VyY2UvV1RGL3d0Zi9GYXN0TWFsbG9jLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMzIzLDcg KzMyMyw3IEBAIFRyeU1hbGxvY1JldHVyblZhbHVlIHRyeUZhc3RSZWFsbG9jKHZvaWQKICAgICAK IFRyeU1hbGxvY1JldHVyblZhbHVlIHRyeUZhc3RDYWxsb2Moc2l6ZV90IG51bUVsZW1lbnRzLCBz aXplX3QgZWxlbWVudFNpemUpCiB7Ci0gICAgcmV0dXJuIGZhc3RDYWxsb2MobnVtRWxlbWVudHMs IGVsZW1lbnRTaXplKTsKKyAgICByZXR1cm4gdHJ5RmFzdFplcm9lZE1hbGxvYyhudW1FbGVtZW50 cyAqIGVsZW1lbnRTaXplKTsKIH0KICAgICAKIHZvaWQgcmVsZWFzZUZhc3RNYWxsb2NGcmVlTWVt b3J5Rm9yVGhpc1RocmVhZCgpCg==