156796 2016-04-20 10:47:32 -0700 Use Optional<size_t> for OrderIterator::m_orderIndex instead of int 2016-04-22 04:29:47 -0700 1 1 1 Unclassified WebKit Layout and Rendering WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=156804 InRadar P2 Normal --- 1 cdumez cdumez andersca commit-queue darin ddkilzer esprehn+autocc glenn kondapallykalyan sam simon.fraser zalan oldest_to_newest 1185455 0 cdumez 2016-04-20 10:47:32 -0700 Use Optional<size_t> for OrderIterator::m_orderIndex instead of int (with invalid value of -1). m_orderIndex a vector index and therefore is in the range of an unsigned (type used internally by Vector, even though the index is exposed as size_t). Therefore, assigning it to an int is unsafe as it may overflow. This may fix <rdar://problem/23410338> which is a top crasher. 1185458 1 276832 cdumez 2016-04-20 10:57:13 -0700 Created attachment 276832 Patch 1185534 2 276832 commit-queue 2016-04-20 14:07:19 -0700 Comment on attachment 276832 Patch Clearing flags on attachment: 276832 Committed r199785: <http://trac.webkit.org/changeset/199785> 1185535 3 commit-queue 2016-04-20 14:07:24 -0700 All reviewed patches have been landed. Closing bug. 1186208 4 ddkilzer 2016-04-22 04:29:47 -0700 <rdar://problem/23410338> 276832 2016-04-20 10:57:13 -0700 2016-04-20 14:07:19 -0700 Patch bug-156796-20160420105734.patch text/plain 3427 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMTk5Nzc0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggOGIzMDRlMzBmYjg0YjAy MWUzMzlmNDQ4ZTAxNDdmYTg0YmQ4YmNjZC4uMmE4MWQ2M2NjNGI4NGJmNmJkNTI2NTdmOGZkZTQx MGQ3ZGU3ZDZhYSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIzIEBACisyMDE2LTA0LTIwICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgVXNlIE9wdGlvbmFsPHNpemVf dD4gZm9yIE9yZGVySXRlcmF0b3I6Om1fb3JkZXJJbmRleCBpbnN0ZWFkIG9mIGludAorICAgICAg ICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTU2Nzk2CisKKyAgICAg ICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVXNlIE9wdGlvbmFsPHNp emVfdD4gZm9yIE9yZGVySXRlcmF0b3I6Om1fb3JkZXJJbmRleCBpbnN0ZWFkIG9mIGludAorICAg ICAgICAod2l0aCBpbnZhbGlkIHZhbHVlIG9mIC0xKS4gbV9vcmRlckluZGV4IGEgdmVjdG9yIGlu ZGV4IGFuZCB0aGVyZWZvcmUKKyAgICAgICAgaXMgaW4gdGhlIHJhbmdlIG9mIGFuIHVuc2lnbmVk ICh0eXBlIHVzZWQgaW50ZXJuYWxseSBieSBWZWN0b3IsIGV2ZW4KKyAgICAgICAgdGhvdWdoIHRo ZSBpbmRleCBpcyBleHBvc2VkIGFzIHNpemVfdCkuIFRoZXJlZm9yZSwgYXNzaWduaW5nIGl0IHRv IGFuCisgICAgICAgIGludCBpcyB1bnNhZmUgYXMgaXQgbWF5IG92ZXJmbG93LgorCisgICAgICAg IFRoaXMgbWF5IGZpeCA8cmRhcjovL3Byb2JsZW0vMjM0MTAzMzg+IHdoaWNoIGlzIGEgdG9wIGNy YXNoZXIuCisKKyAgICAgICAgKiByZW5kZXJpbmcvT3JkZXJJdGVyYXRvci5jcHA6CisgICAgICAg IChXZWJDb3JlOjpPcmRlckl0ZXJhdG9yOjpuZXh0KToKKyAgICAgICAgKFdlYkNvcmU6Ok9yZGVy SXRlcmF0b3I6OnJlc2V0KToKKyAgICAgICAgKiByZW5kZXJpbmcvT3JkZXJJdGVyYXRvci5oOgor CiAyMDE2LTA0LTIwICBCcmFkeSBFaWRzb24gIDxiZWlkc29uQGFwcGxlLmNvbT4KIAogICAgICAg ICBBZGRyZXNzaW5nIGFkZGl0aW9uYWwgcmV2aWV3IGZlZWRiYWNrIGZvcjoKZGlmZiAtLWdpdCBh L1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9PcmRlckl0ZXJhdG9yLmNwcCBiL1NvdXJjZS9XZWJD b3JlL3JlbmRlcmluZy9PcmRlckl0ZXJhdG9yLmNwcAppbmRleCA2NTZkYjM2MDNkMzVhZjhlYmQw NzkxMWMxMTBhOWNhZjc5NTNiNzBlLi4yZjk0Zjg1MTFhYWQ1NWEwZjhlN2EyMTFlMzc5MmY5NzAx NTA4NzJlIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvT3JkZXJJdGVyYXRv ci5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL09yZGVySXRlcmF0b3IuY3BwCkBA IC0zNiw4ICszNiw2IEBACiAKIG5hbWVzcGFjZSBXZWJDb3JlIHsKIAotc3RhdGljIGNvbnN0IGlu dCBjSW52YWxpZEluZGV4ID0gLTE7Ci0KIE9yZGVySXRlcmF0b3I6Ok9yZGVySXRlcmF0b3IoUmVu ZGVyQm94JiBjb250YWluZXJCb3gpCiAgICAgOiBtX2NvbnRhaW5lckJveChjb250YWluZXJCb3gp CiB7CkBAIC01MiwyMyArNTAsMjIgQEAgUmVuZGVyQm94KiBPcmRlckl0ZXJhdG9yOjpmaXJzdCgp CiAKIFJlbmRlckJveCogT3JkZXJJdGVyYXRvcjo6bmV4dCgpCiB7Ci0gICAgaW50IGVuZEluZGV4 ID0gbV9vcmRlclZhbHVlcy5zaXplKCk7CiAgICAgZG8gewogICAgICAgICBpZiAobV9jdXJyZW50 Q2hpbGQpIHsKICAgICAgICAgICAgIG1fY3VycmVudENoaWxkID0gbV9jdXJyZW50Q2hpbGQtPm5l eHRTaWJsaW5nQm94KCk7CiAgICAgICAgICAgICBjb250aW51ZTsKICAgICAgICAgfQogCi0gICAg ICAgIGlmIChtX29yZGVySW5kZXggIT0gY0ludmFsaWRJbmRleCkKLSAgICAgICAgICAgICsrbV9v cmRlckluZGV4OworICAgICAgICBpZiAobV9vcmRlckluZGV4KQorICAgICAgICAgICAgKyttX29y ZGVySW5kZXgudmFsdWUoKTsKICAgICAgICAgZWxzZQogICAgICAgICAgICAgbV9vcmRlckluZGV4 ID0gMDsKIAotICAgICAgICBpZiAobV9vcmRlckluZGV4ID09IGVuZEluZGV4KQorICAgICAgICBp ZiAobV9vcmRlckluZGV4LnZhbHVlKCkgPj0gbV9vcmRlclZhbHVlcy5zaXplKCkpCiAgICAgICAg ICAgICByZXR1cm4gbnVsbHB0cjsKIAogICAgICAgICBtX2N1cnJlbnRDaGlsZCA9IG1fY29udGFp bmVyQm94LmZpcnN0Q2hpbGRCb3goKTsKLSAgICB9IHdoaWxlICghbV9jdXJyZW50Q2hpbGQgfHwg bV9jdXJyZW50Q2hpbGQtPnN0eWxlKCkub3JkZXIoKSAhPSBtX29yZGVyVmFsdWVzW21fb3JkZXJJ bmRleF0pOworICAgIH0gd2hpbGUgKCFtX2N1cnJlbnRDaGlsZCB8fCBtX2N1cnJlbnRDaGlsZC0+ c3R5bGUoKS5vcmRlcigpICE9IG1fb3JkZXJWYWx1ZXNbbV9vcmRlckluZGV4LnZhbHVlKCldKTsK IAogICAgIHJldHVybiBtX2N1cnJlbnRDaGlsZDsKIH0KQEAgLTc2LDcgKzczLDcgQEAgUmVuZGVy Qm94KiBPcmRlckl0ZXJhdG9yOjpuZXh0KCkKIHZvaWQgT3JkZXJJdGVyYXRvcjo6cmVzZXQoKQog ewogICAgIG1fY3VycmVudENoaWxkID0gbnVsbHB0cjsKLSAgICBtX29yZGVySW5kZXggPSBjSW52 YWxpZEluZGV4OworICAgIG1fb3JkZXJJbmRleCA9IE51bGxvcHQ7CiB9CiAKIE9yZGVySXRlcmF0 b3JQb3B1bGF0b3I6Ok9yZGVySXRlcmF0b3JQb3B1bGF0b3IoT3JkZXJJdGVyYXRvciYgaXRlcmF0 b3IpCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvT3JkZXJJdGVyYXRvci5o IGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL09yZGVySXRlcmF0b3IuaAppbmRleCA1MmYzZjEx N2Q2Njg1MTVkYmQ0NzE2ZDQ2ZDBkNmFhODc0YzI3MzBlLi43ZmU3ZTlhYTUwNzVkMGI5NzE4NmEw NWY1MTY4Yzk4YjRjZmMwMzExIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcv T3JkZXJJdGVyYXRvci5oCisrKyBiL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9PcmRlckl0ZXJh dG9yLmgKQEAgLTMzLDYgKzMzLDcgQEAKICNkZWZpbmUgT3JkZXJJdGVyYXRvcl9oCiAKICNpbmNs dWRlIDx3dGYvTm9uY29weWFibGUuaD4KKyNpbmNsdWRlIDx3dGYvT3B0aW9uYWwuaD4KICNpbmNs dWRlIDx3dGYvVmVjdG9yLmg+CiAKIG5hbWVzcGFjZSBXZWJDb3JlIHsKQEAgLTU2LDcgKzU3LDcg QEAgcHJpdmF0ZToKICAgICBSZW5kZXJCb3gqIG1fY3VycmVudENoaWxkOwogCiAgICAgVmVjdG9y PGludCwgMT4gbV9vcmRlclZhbHVlczsKLSAgICBpbnQgbV9vcmRlckluZGV4OworICAgIE9wdGlv bmFsPHNpemVfdD4gbV9vcmRlckluZGV4OwogfTsKIAogY2xhc3MgT3JkZXJJdGVyYXRvclBvcHVs YXRvciB7Cg==