176232 2017-09-01 10:47:48 -0700 transformCanLikelyUseFastPath() can read off the end of a string 2017-09-05 08:52:13 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 simon.fraser simon.fraser commit-queue darin dino simon.fraser thorton zalan oldest_to_newest 1344458 0 simon.fraser 2017-09-01 10:47:48 -0700 transformCanLikelyUseFastPath() can read off the end of a string 1344461 1 319617 simon.fraser 2017-09-01 10:53:36 -0700 Created attachment 319617 Patch 1344462 2 simon.fraser 2017-09-01 10:54:01 -0700 rdar://problem/33851237 1344503 3 319617 commit-queue 2017-09-01 11:49:05 -0700 Comment on attachment 319617 Patch Clearing flags on attachment: 319617 Committed r221488: <http://trac.webkit.org/changeset/221488> 1344504 4 commit-queue 2017-09-01 11:49:06 -0700 All reviewed patches have been landed. Closing bug. 1345086 5 319617 darin 2017-09-03 17:12:49 -0700 Comment on attachment 319617 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=319617&action=review > Source/WebCore/ChangeLog:11 > + Code added in r220382 could read one byte past the end of the string when looking for the 'z' > + of a rotateZ() function. The code was actually incorrect, testing for the 'z at i+6 after > + already incrementing i by 6. This patch makes the code correctly detect rotateZ(). Is there a test we can write that would have failed before because of the bad "z" check? > Source/WebCore/css/parser/CSSParserFastPaths.cpp:1271 > - if (toASCIILower(chars[i + 6]) == 'z') > + if (toASCIILower(chars[i]) == 'z') Not that this tiny bit of efficiency matters, but all of these can be written more efficiently: if (isASCIIAlphaCaselessEqual(chars[i], 'z')) Same applies for all the other checks above. 1345458 6 simon.fraser 2017-09-05 08:52:13 -0700 (In reply to Darin Adler from comment #5) > Comment on attachment 319617 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=319617&action=review > > > Source/WebCore/ChangeLog:11 > > + Code added in r220382 could read one byte past the end of the string when looking for the 'z' > > + of a rotateZ() function. The code was actually incorrect, testing for the 'z at i+6 after > > + already incrementing i by 6. This patch makes the code correctly detect rotateZ(). > > Is there a test we can write that would have failed before because of the > bad "z" check? No, becuasse we'd just fail the fast parsing and fall back to normal parsing (which is not detectable). > > Source/WebCore/css/parser/CSSParserFastPaths.cpp:1271 > > - if (toASCIILower(chars[i + 6]) == 'z') > > + if (toASCIILower(chars[i]) == 'z') > > Not that this tiny bit of efficiency matters, but all of these can be > written more efficiently: > > if (isASCIIAlphaCaselessEqual(chars[i], 'z')) > > Same applies for all the other checks above. Good to know, will fix. 319617 2017-09-01 10:53:36 -0700 2017-09-01 11:49:05 -0700 Patch bug-176232-20170901105335.patch text/plain 5511 simon.fraser U3VidmVyc2lvbiBSZXZpc2lvbjogMjIxNDcwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMTdiYjNlYjZlZWJjMGU0 YjgyMzM4NjU4Mzk5Nzk2MjFiYWM4OWI1Mi4uOWVjZGMxNGI1NWRjOTU0NzQyYWMxMGEyNWMyYzY0 NTUxZWM3MDM1ZSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI4IEBACisyMDE3LTA5LTAxICBTaW1v biBGcmFzZXIgIDxzaW1vbi5mcmFzZXJAYXBwbGUuY29tPgorCisgICAgICAgIHRyYW5zZm9ybUNh bkxpa2VseVVzZUZhc3RQYXRoKCkgY2FuIHJlYWQgb2ZmIHRoZSBlbmQgb2YgYSBzdHJpbmcKKyAg ICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE3NjIzMgorICAg ICAgICByZGFyOi8vcHJvYmxlbS8zMzg1MTIzNworCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorICAgICAgICAKKyAgICAgICAgQ29kZSBhZGRlZCBpbiByMjIwMzgyIGNvdWxk IHJlYWQgb25lIGJ5dGUgcGFzdCB0aGUgZW5kIG9mIHRoZSBzdHJpbmcgd2hlbiBsb29raW5nIGZv ciB0aGUgJ3onCisgICAgICAgIG9mIGEgcm90YXRlWigpIGZ1bmN0aW9uLiBUaGUgY29kZSB3YXMg YWN0dWFsbHkgaW5jb3JyZWN0LCB0ZXN0aW5nIGZvciB0aGUgJ3ogYXQgaSs2IGFmdGVyCisgICAg ICAgIGFscmVhZHkgaW5jcmVtZW50aW5nIGkgYnkgNi4gVGhpcyBwYXRjaCBtYWtlcyB0aGUgY29k ZSBjb3JyZWN0bHkgZGV0ZWN0IHJvdGF0ZVooKS4KKyAgICAgICAgCisgICAgICAgIEFsc28sIHJv dGF0ZSBmdW5jdGlvbnMgYXQgdGhlIGVuZCBvZiBhIHN0cmluZyBjb3VsZCBiZSBpZ25vcmVkIGJl Y2F1c2Uga1Nob3J0ZXN0VmFsaWRUcmFuc2Zvcm1TdHJpbmdMZW5ndGgKKyAgICAgICAgd2FzIHRv byBsb25nLCBzbyBzZXQgaXQgdG8gdGhlIGxlbmd0aCBvZiAicm90YXRlKDApIiwgdGhlIHNob3J0 ZXN0IHRyYW5zZm9ybSBmdW5jdGlvbiB0aGF0IHdlIGN1cnJlbnRseQorICAgICAgICBmYXN0LXBh cnNlLgorCisgICAgICAgIFRoZXJlJ3MgYW4gaW1wbGljaXQgYXNzdW1wdGlvbiBpbiB0aGlzIGNv ZGUgdGhhdCBjaGFycyBpcyBub3QgaW5kZXhlZCBwYXN0IGkra1Nob3J0ZXN0VmFsaWRUcmFuc2Zv cm1TdHJpbmdMZW5ndGguCisgICAgICAgIElmIHRoZSAndHJhbnNsYXRlJyBwYXRoIGlzIHRha2Vu LCBpIGlzIGluY3JlbWVudGVkIGJ5IDkgKD09a1Nob3J0ZXN0VmFsaWRUcmFuc2Zvcm1TdHJpbmdM ZW5ndGgpLCBidXQgdGhhdCdzCisgICAgICAgIE9LIGJlY2F1c2UgV1RGOjpmaW5kKCkgZG9lc24n dCBpbmRleCBpbnRvIGNoYXJzIGlmIGkgPj0gbGVuZ3RoLgorCisgICAgICAgIFRlc3Q6IGZhc3Qv Y3NzL3RyYW5zZm9ybS1mYXN0LXBhdGhzLmh0bWwKKworICAgICAgICAqIGNzcy9wYXJzZXIvQ1NT UGFyc2VyRmFzdFBhdGhzLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OnRyYW5zZm9ybUNhbkxpa2Vs eVVzZUZhc3RQYXRoKToKKwogMjAxNy0wOC0zMSAgRGFuaWVsIEJhdGVzICA8ZGFiYXRlc0BhcHBs ZS5jb20+CiAKICAgICAgICAgQW5vdGhlciBhdHRlbXB0IHRvIGZpeCB0aGUgQXBwbGUgV2luZG93 cyBidWlsZCBmb2xsb3dpbmcgPGh0dHBzOi8vdHJhYy53ZWJraXQub3JnL2NoYW5nZXNldC8yMjE0 NTk+CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9jc3MvcGFyc2VyL0NTU1BhcnNlckZhc3RQ YXRocy5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9jc3MvcGFyc2VyL0NTU1BhcnNlckZhc3RQYXRocy5j cHAKaW5kZXggZDIzODMyY2VhYmQ1YmM2ZjBlMjU1MjExOWY1NjRiNGY0ODg2YTRhYS4uZDQyZjY1 NDIwOTBlNDQzYjk1OTIwM2FjNzk0YzFlZDA0MjYwZjdhNCAxMDA2NDQKLS0tIGEvU291cmNlL1dl YkNvcmUvY3NzL3BhcnNlci9DU1NQYXJzZXJGYXN0UGF0aHMuY3BwCisrKyBiL1NvdXJjZS9XZWJD b3JlL2Nzcy9wYXJzZXIvQ1NTUGFyc2VyRmFzdFBhdGhzLmNwcApAQCAtMTExNSw3ICsxMTE1LDcg QEAgc3RhdGljIGJvb2wgcGFyc2VUcmFuc2Zvcm1OdW1iZXJBcmd1bWVudHMoQ2hhclR5cGUqJiBw b3MsIENoYXJUeXBlKiBlbmQsIHVuc2lnbmUKICAgICByZXR1cm4gdHJ1ZTsKIH0KIAotc3RhdGlj IGNvbnN0IGludCBrU2hvcnRlc3RWYWxpZFRyYW5zZm9ybVN0cmluZ0xlbmd0aCA9IDEyOworc3Rh dGljIGNvbnN0IGludCBrU2hvcnRlc3RWYWxpZFRyYW5zZm9ybVN0cmluZ0xlbmd0aCA9IDk7IC8v ICJyb3RhdGUoMCkiCiAKIHRlbXBsYXRlIDx0eXBlbmFtZSBDaGFyVHlwZT4KIHN0YXRpYyBSZWZQ dHI8Q1NTRnVuY3Rpb25WYWx1ZT4gcGFyc2VTaW1wbGVUcmFuc2Zvcm1WYWx1ZShDaGFyVHlwZSom IHBvcywgQ2hhclR5cGUqIGVuZCkKQEAgLTEyMzksOCArMTIzOSwxMCBAQCBzdGF0aWMgYm9vbCB0 cmFuc2Zvcm1DYW5MaWtlbHlVc2VGYXN0UGF0aChjb25zdCBDaGFyVHlwZSogY2hhcnMsIHVuc2ln bmVkIGxlbmd0aAogICAgICAgICAgICAgKytpOwogICAgICAgICAgICAgY29udGludWU7CiAgICAg ICAgIH0KKwogICAgICAgICBpZiAobGVuZ3RoIC0gaSA8IGtTaG9ydGVzdFZhbGlkVHJhbnNmb3Jt U3RyaW5nTGVuZ3RoKQogICAgICAgICAgICAgcmV0dXJuIGZhbHNlOworICAgICAgICAKICAgICAg ICAgc3dpdGNoICh0b0FTQ0lJTG93ZXIoY2hhcnNbaV0pKSB7CiAgICAgICAgIGNhc2UgJ3QnOgog ICAgICAgICAgICAgLy8gdHJhbnNsYXRlLCB0cmFuc2xhdGVYLCB0cmFuc2xhdGVZLCB0cmFuc2xh dGVaLCB0cmFuc2xhdGUzZC4KQEAgLTEyNjYsMTIgKzEyNjgsMTEgQEAgc3RhdGljIGJvb2wgdHJh bnNmb3JtQ2FuTGlrZWx5VXNlRmFzdFBhdGgoY29uc3QgQ2hhclR5cGUqIGNoYXJzLCB1bnNpZ25l ZCBsZW5ndGgKICAgICAgICAgICAgICAgICByZXR1cm4gZmFsc2U7CiAgICAgICAgICAgICBpICs9 IDY7CiAgICAgICAgICAgICAvLyByb3RhdGVaCi0gICAgICAgICAgICBpZiAodG9BU0NJSUxvd2Vy KGNoYXJzW2kgKyA2XSkgPT0gJ3onKQorICAgICAgICAgICAgaWYgKHRvQVNDSUlMb3dlcihjaGFy c1tpXSkgPT0gJ3onKQogICAgICAgICAgICAgICAgICsraTsKICAgICAgICAgICAgIGJyZWFrOwog CiAgICAgICAgIGRlZmF1bHQ6Ci0gICAgICAgICAgICAvLyBBbGwgb3RoZXIgdGhpbmdzLCBleC4g cm90YXRlLgogICAgICAgICAgICAgcmV0dXJuIGZhbHNlOwogICAgICAgICB9CiAgICAgICAgIHNp emVfdCBhcmd1bWVudHNFbmQgPSBXVEY6OmZpbmQoY2hhcnMsIGxlbmd0aCwgJyknLCBpKTsKZGlm ZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwpp bmRleCBjNjEyZTI1ZWM1ZTM0MDM5ZmQyYzFjOWNlNTdiMWJjMzE4NDA5NmI3Li42MTYyYWYyNjc2 MTJkMTliNjcwMTMxMmZlMjA3MzdlODBiMjNjNDE1IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9D aGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTQgQEAKKzIw MTctMDktMDEgIFNpbW9uIEZyYXNlciAgPHNpbW9uLmZyYXNlckBhcHBsZS5jb20+CisKKyAgICAg ICAgdHJhbnNmb3JtQ2FuTGlrZWx5VXNlRmFzdFBhdGgoKSBjYW4gcmVhZCBvZmYgdGhlIGVuZCBv ZiBhIHN0cmluZworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/ aWQ9MTc2MjMyCisgICAgICAgIHJkYXI6Ly9wcm9ibGVtLzMzODUxMjM3CisKKyAgICAgICAgUmV2 aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBmYXN0L2Nzcy90cmFuc2Zvcm0t ZmFzdC1wYXRocy1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGZhc3QvY3NzL3RyYW5z Zm9ybS1mYXN0LXBhdGhzLmh0bWw6IEFkZGVkLgorCiAyMDE3LTA4LTMxICBTYW0gV2VpbmlnICA8 c2FtQHdlYmtpdC5vcmc+CiAKICAgICAgICAgSW1wbGVtZW50IERPTU1hdHJpeDJESW5pdCBmb3Ig c2V0VHJhbnNmb3JtKCkvYWRkUGF0aCgpCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L2Nz cy90cmFuc2Zvcm0tZmFzdC1wYXRocy1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9mYXN0L2Nz cy90cmFuc2Zvcm0tZmFzdC1wYXRocy1leHBlY3RlZC50eHQKbmV3IGZpbGUgbW9kZSAxMDA2NDQK aW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uZTI3NzEzNjU4 OTcyYjM3MmFlN2Y3MjU3MDE3ODJjZGE0ODIyYWY2ZAotLS0gL2Rldi9udWxsCisrKyBiL0xheW91 dFRlc3RzL2Zhc3QvY3NzL3RyYW5zZm9ybS1mYXN0LXBhdGhzLWV4cGVjdGVkLnR4dApAQCAtMCww ICsxIEBACitUZXN0IHRlc3Qgc2hvdWxkIG5vdCB0cmlnZ2VyIGFueSBpbnZhbGlkIG1lbW9yeSBh Y2Nlc3NlcyB3aGVuIHJ1bm5pbmcgdW5kZXIgQVNhbi4KZGlmZiAtLWdpdCBhL0xheW91dFRlc3Rz L2Zhc3QvY3NzL3RyYW5zZm9ybS1mYXN0LXBhdGhzLmh0bWwgYi9MYXlvdXRUZXN0cy9mYXN0L2Nz cy90cmFuc2Zvcm0tZmFzdC1wYXRocy5odG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLjQ0MmUzNGM1ZDc1N2M4ZGY0 ZWRiYjFjZDM3OTJmNDUyNmVhYWYyZjgKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9m YXN0L2Nzcy90cmFuc2Zvcm0tZmFzdC1wYXRocy5odG1sCkBAIC0wLDAgKzEsMTkgQEAKKzwhRE9D VFlQRSBodG1sPgorPGh0bWw+Cis8Ym9keT4KKyAgICBUZXN0IHRlc3Qgc2hvdWxkIG5vdCB0cmln Z2VyIGFueSBpbnZhbGlkIG1lbW9yeSBhY2Nlc3NlcyB3aGVuIHJ1bm5pbmcgdW5kZXIgQVNhbi4K KworPHNjcmlwdD4KKyAgICBpZiAod2luZG93LnRlc3RSdW5uZXIpCisgICAgICAgIHRlc3RSdW5u ZXIuZHVtcEFzVGV4dCgpOworCisgICAgdmFyIGhlYWRpbmcgPSBkb2N1bWVudC5jcmVhdGVFbGVt ZW50KCJkaXYiKTsKKyAgICBoZWFkaW5nLnN0eWxlLnNldFByb3BlcnR5KCJ0cmFuc2Zvcm0iLCAi cm90YXRlWig4ZGVnKSIpOworICAgIGhlYWRpbmcuc3R5bGUuc2V0UHJvcGVydHkoInRyYW5zZm9y bSIsICJyb3RhdGUoMCkiKTsKKyAgICBoZWFkaW5nLnN0eWxlLnNldFByb3BlcnR5KCJ0cmFuc2Zv cm0iLCAidHJhbnNsYXRlIik7CisgICAgaGVhZGluZy5zdHlsZS5zZXRQcm9wZXJ0eSgidHJhbnNm b3JtIiwgInRyYW5zbGF0ZSgwcHgsIDFweCkgcm90YXRlKDBkZWcpIHRyYW5zbGF0ZSgwcHgsIDBw eCkgcm90YXRlKDBkZWcpIik7CisgICAgaGVhZGluZy5zdHlsZS5zZXRQcm9wZXJ0eSgidHJhbnNm b3JtIiwgInRyYW5zbGF0ZSgwcHgsIDFweCkgcm90YXRlKDBkZWcpIHRyYW5zbGF0ZSgwcHgsIDBw eCkgcm90YXRlKDApIik7CisgICAgaGVhZGluZy5zdHlsZS5zZXRQcm9wZXJ0eSgidHJhbnNmb3Jt IiwgInRyYW5zbGF0ZSgwcHgsIDFweCkgcm90YXRlKDBkZWcpIHRyYW5zbGF0ZSgwcHgsIDBweCkg cm90YXRlIik7Cis8L3NjcmlwdD4KKzwvYm9keT4KKzwvaHRtbD4K