196664 2019-04-05 16:21:14 -0700 Undefined Behavior: m_experimentalImageMenuEnabled isn't initialized in HTMLImageElement when SERVICE_CONTROLS is disabled 2019-04-08 10:28:18 -0700 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 196533 1 chris.reid webkit-unassigned achristensen cdumez commit-queue don.olmstead esprehn+autocc ews-watchlist fujii gyuyoung.kim ross.kirsling webkit-bug-importer ysuzuki oldest_to_newest 1524888 0 chris.reid 2019-04-05 16:21:14 -0700 m_experimentalImageMenuEnabled is only initialized when SERVICE_CONTROLS is enabled but used regardless. This doesn't seem to cause an observable bug. SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ..\..\Source\WebCore\dom/Document.cpp:2630:23 in ..\..\Source\WebCore\html\HTMLImageElement.h:112:45: runtime error: load of value 190, which is not a valid value for type 'bool' #0 0x7ffbfe807508 in WebCore::HTMLImageElement::hasShadowControls C:\git\neko\Source\WebCore\html\HTMLImageElement.h:112 #1 0x7ffbfe7e82c4 in WebCore::RenderImage::RenderImage C:\git\neko\Source\WebCore\rendering\RenderImage.cpp:142 #2 0x7ffbfcdf9358 in WebCore::createRenderer<WebCore::RenderImage,WebCore::HTMLImageElement &,WebCore::RenderStyle,nullptr_t,float &> C:\git\neko\Source\WebCore\rendering\RenderPtr.h:43 #3 0x7ffbfcde6766 in WebCore::HTMLImageElement::createElementRenderer C:\git\neko\Source\WebCore\html\HTMLImageElement.cpp:282 #4 0x7ffc02d68bb2 in WebCore::RenderTreeUpdater::createRenderer C:\git\neko\Source\WebCore\rendering\updating\RenderTreeUpdater.cpp:363 #5 0x7ffc02d62ad0 in WebCore::RenderTreeUpdater::updateElementRenderer C:\git\neko\Source\WebCore\rendering\updating\RenderTreeUpdater.cpp:323 #6 0x7ffc02d60085 in WebCore::RenderTreeUpdater::updateRenderTree C:\git\neko\Source\WebCore\rendering\updating\RenderTreeUpdater.cpp:187 #7 0x7ffc02d5df06 in WebCore::RenderTreeUpdater::commit C:\git\neko\Source\WebCore\rendering\updating\RenderTreeUpdater.cpp:119 1524889 1 366856 chris.reid 2019-04-05 16:24:01 -0700 Created attachment 366856 patch 1524896 2 366856 ross.kirsling 2019-04-05 16:31:56 -0700 Comment on attachment 366856 patch Seems correct, given that the declaration isn't #if-ed. 1525232 3 366856 commit-queue 2019-04-08 10:27:40 -0700 Comment on attachment 366856 patch Clearing flags on attachment: 366856 Committed r244025: <https://trac.webkit.org/changeset/244025> 1525233 4 commit-queue 2019-04-08 10:27:42 -0700 All reviewed patches have been landed. Closing bug. 1525234 5 webkit-bug-importer 2019-04-08 10:28:18 -0700 <rdar://problem/49700740> 366856 2019-04-05 16:24:01 -0700 2019-04-08 10:27:40 -0700 patch 196664.diff text/plain 1382 chris.reid ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZwppbmRleCBlMTkwYjg4OWMxYS4uNWQ2MTU0MjQzZjcgMTAwNjQ0Ci0tLSBhL1NvdXJj ZS9XZWJDb3JlL0NoYW5nZUxvZworKysgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxNiBAQAorMjAxOS0wNC0wNSAgQ2hyaXN0b3BoZXIgUmVpZCAgPGNocmlzLnJlaWRAc29u eS5jb20+CisKKyAgICAgICAgVW5kZWZpbmVkIEJlaGF2aW9yOiBtX2V4cGVyaW1lbnRhbEltYWdl TWVudUVuYWJsZWQgaXNuJ3QgaW5pdGlhbGl6ZWQgaW4gSFRNTEltYWdlRWxlbWVudCB3aGVuIFNF UlZJQ0VfQ09OVFJPTFMgaXMgZGlzYWJsZWQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5v cmcvc2hvd19idWcuY2dpP2lkPTE5NjY2NAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo T09QUyEpLgorCisgICAgICAgIE5vIG9ic2VydmFibGUgY2hhbmdlIGluIGJlaGF2aW9yLgorCisg ICAgICAgIEluaXRpYWxpemUgbV9leHBlcmltZW50YWxJbWFnZU1lbnVFbmFibGVkIHJlZ2FyZGxl c3Mgb2YgRU5BQkxFKFNFUlZJQ0VfQ09OVFJPTFMpCisKKyAgICAgICAgKiBodG1sL0hUTUxJbWFn ZUVsZW1lbnQuY3BwOgorCiAyMDE5LTAzLTI3ICBKdXN0aW4gRmFuICA8anVzdGluX2ZhbkBhcHBs ZS5jb20+CiAKICAgICAgICAgW1dlYiBHUFVdIFN0YW5kYXJkaXplIFdlYiBHUFUgb2JqZWN0IHJl ZmVyZW5jZSBjb3VudGluZyBhbmQgY3JlYXRpb24gbG9naWMKZGlmZiAtLWdpdCBhL1NvdXJjZS9X ZWJDb3JlL2h0bWwvSFRNTEltYWdlRWxlbWVudC5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9odG1sL0hU TUxJbWFnZUVsZW1lbnQuY3BwCmluZGV4IGQwNDc5NzhmYzhkLi45MzEyZTZmOGQ3NCAxMDA2NDQK LS0tIGEvU291cmNlL1dlYkNvcmUvaHRtbC9IVE1MSW1hZ2VFbGVtZW50LmNwcAorKysgYi9Tb3Vy Y2UvV2ViQ29yZS9odG1sL0hUTUxJbWFnZUVsZW1lbnQuY3BwCkBAIC03NCw5ICs3NCw3IEBAIEhU TUxJbWFnZUVsZW1lbnQ6OkhUTUxJbWFnZUVsZW1lbnQoY29uc3QgUXVhbGlmaWVkTmFtZSYgdGFn TmFtZSwgRG9jdW1lbnQmIGRvY3VtCiAgICAgLCBtX2Zvcm1TZXRCeVBhcnNlcihmb3JtKQogICAg ICwgbV9jb21wb3NpdGVPcGVyYXRvcihDb21wb3NpdGVTb3VyY2VPdmVyKQogICAgICwgbV9pbWFn ZURldmljZVBpeGVsUmF0aW8oMS4wZikKLSNpZiBFTkFCTEUoU0VSVklDRV9DT05UUk9MUykKICAg ICAsIG1fZXhwZXJpbWVudGFsSW1hZ2VNZW51RW5hYmxlZChmYWxzZSkKLSNlbmRpZgogewogICAg IEFTU0VSVChoYXNUYWdOYW1lKGltZ1RhZykpOwogICAgIHNldEhhc0N1c3RvbVN0eWxlUmVzb2x2 ZUNhbGxiYWNrcygpOwo=