<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>228058</bug_id>
          
          <creation_ts>2021-07-18 09:27:36 -0700</creation_ts>
          <short_desc>Fix canvas overflow checking to use CheckedArithmatic rather than adhoc floating point mechanism</short_desc>
          <delta_ts>2021-07-19 12:40:44 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>New Bugs</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Sam Weinig">sam</reporter>
          <assigned_to name="Sam Weinig">sam</assigned_to>
          <cc>cdumez</cc>
    
    <cc>changseok</cc>
    
    <cc>darin</cc>
    
    <cc>dino</cc>
    
    <cc>esprehn+autocc</cc>
    
    <cc>ews-watchlist</cc>
    
    <cc>gyuyoung.kim</cc>
    
    <cc>sabouhallawa</cc>
    
    <cc>sam</cc>
    
    <cc>webkit-bug-importer</cc>
    
    <cc>zalan</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1777755</commentid>
    <comment_count>0</comment_count>
    <who name="Sam Weinig">sam</who>
    <bug_when>2021-07-18 09:27:36 -0700</bug_when>
    <thetext>Fix canvas overflow checking to use CheckedArithmatic rather than adhoc floating point mechanism</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1777756</commentid>
    <comment_count>1</comment_count>
      <attachid>433750</attachid>
    <who name="Sam Weinig">sam</who>
    <bug_when>2021-07-18 09:28:25 -0700</bug_when>
    <thetext>Created attachment 433750
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1777767</commentid>
    <comment_count>2</comment_count>
    <who name="EWS">ews-feeder</who>
    <bug_when>2021-07-18 12:18:28 -0700</bug_when>
    <thetext>Committed r280020 (239762@main): &lt;https://commits.webkit.org/239762@main&gt;

All reviewed patches have been landed. Closing bug and clearing flags on attachment 433750.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1777768</commentid>
    <comment_count>3</comment_count>
    <who name="Radar WebKit Bug Importer">webkit-bug-importer</who>
    <bug_when>2021-07-18 12:19:17 -0700</bug_when>
    <thetext>&lt;rdar://problem/80748974&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1777938</commentid>
    <comment_count>4</comment_count>
      <attachid>433750</attachid>
    <who name="Said Abou-Hallawa">sabouhallawa</who>
    <bug_when>2021-07-19 12:20:24 -0700</bug_when>
    <thetext>Comment on attachment 433750
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=433750&amp;action=review

&gt; Source/WebCore/html/HTMLCanvasElement.cpp:879
&gt;  #if USE(IOSURFACE_CANVAS_BACKING_STORE)

Should not this #if be moved to the beginning of the function since #if USE(IOSURFACE_CANVAS_BACKING_STORE) is false, we are going to return false always?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1777945</commentid>
    <comment_count>5</comment_count>
      <attachid>433750</attachid>
    <who name="Sam Weinig">sam</who>
    <bug_when>2021-07-19 12:40:44 -0700</bug_when>
    <thetext>Comment on attachment 433750
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=433750&amp;action=review

&gt;&gt; Source/WebCore/html/HTMLCanvasElement.cpp:879
&gt;&gt;  #if USE(IOSURFACE_CANVAS_BACKING_STORE)
&gt; 
&gt; Should not this #if be moved to the beginning of the function since #if USE(IOSURFACE_CANVAS_BACKING_STORE) is false, we are going to return false always?

Sure, though that seems unrelated to the change. Seems like a fine change. If I was changing something like that, I would probably also add a better macro for this that isn&apos;t platform specific.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>433750</attachid>
            <date>2021-07-18 09:28:25 -0700</date>
            <delta_ts>2021-07-18 12:18:29 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-228058-20210718092824.patch</filename>
            <type>text/plain</type>
            <size>4432</size>
            <attacher name="Sam Weinig">sam</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi
Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDI4MDAxOSkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n
ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE3IEBACisyMDIxLTA3LTE4ICBTYW0gV2Vp
bmlnICA8d2VpbmlnQGFwcGxlLmNvbT4KKworICAgICAgICBGaXggY2FudmFzIG92ZXJmbG93IGNo
ZWNraW5nIHRvIHVzZSBDaGVja2VkQXJpdGhtYXRpYyByYXRoZXIgdGhhbiBhZGhvYyBmbG9hdGlu
ZyBwb2ludCBtZWNoYW5pc20KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i
dWcuY2dpP2lkPTIyODA1OAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgor
CisgICAgICAgIFdlIGhhdmUgQ2hlY2tlZEFyaXRobWF0aWMganVzdCBmb3IgdGhpcyBjYXNlLiBV
c2UgaXQuCisKKyAgICAgICAgKiBodG1sL0hUTUxDYW52YXNFbGVtZW50LmNwcDoKKyAgICAgICAg
KFdlYkNvcmU6OkhUTUxDYW52YXNFbGVtZW50OjpzaG91bGRBY2NlbGVyYXRlIGNvbnN0KToKKyAg
ICAgICAgKFdlYkNvcmU6OkhUTUxDYW52YXNFbGVtZW50OjpjcmVhdGVJbWFnZUJ1ZmZlciBjb25z
dCk6CisgICAgICAgICogaHRtbC9IVE1MQ2FudmFzRWxlbWVudC5oOgorCiAyMDIxLTA3LTE4ICBX
ZW5zb24gSHNpZWggIDx3ZW5zb25faHNpZWhAYXBwbGUuY29tPgogCiAgICAgICAgIFtpT1NdIFtB
WF0gS2V5Ym9hcmQgdGV4dCBjYW5kaWRhdGVzIGRvbid0IHVwZGF0ZSB3aGVuIGNoYW5naW5nIHNl
bGVjdGlvbiB1c2luZyBTd2l0Y2ggQ29udHJvbApJbmRleDogU291cmNlL1dlYkNvcmUvaHRtbC9I
VE1MQ2FudmFzRWxlbWVudC5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvaHRtbC9I
VE1MQ2FudmFzRWxlbWVudC5jcHAJKHJldmlzaW9uIDI3OTg3MikKKysrIFNvdXJjZS9XZWJDb3Jl
L2h0bWwvSFRNTENhbnZhc0VsZW1lbnQuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC04NjIsMTkgKzg2
MiwyMyBAQCBTZWN1cml0eU9yaWdpbiogSFRNTENhbnZhc0VsZW1lbnQ6OnNlY3VyCiAKIGJvb2wg
SFRNTENhbnZhc0VsZW1lbnQ6OnNob3VsZEFjY2VsZXJhdGUoY29uc3QgSW50U2l6ZSYgc2l6ZSkg
Y29uc3QKIHsKLSAgICBhdXRvJiBzZXR0aW5ncyA9IGRvY3VtZW50KCkuc2V0dGluZ3MoKTsKLQot
ICAgIGF1dG8gYXJlYSA9IHNpemUuYXJlYTxSZWNvcmRPdmVyZmxvdz4oKTsKLSAgICBpZiAoYXJl
YS5oYXNPdmVyZmxvd2VkKCkpCisgICAgYXV0byBjaGVja2VkQXJlYSA9IHNpemUuYXJlYTxSZWNv
cmRPdmVyZmxvdz4oKTsKKyAgICBpZiAoY2hlY2tlZEFyZWEuaGFzT3ZlcmZsb3dlZCgpKQogICAg
ICAgICByZXR1cm4gZmFsc2U7CiAKKyAgICByZXR1cm4gc2hvdWxkQWNjZWxlcmF0ZShjaGVja2Vk
QXJlYS52YWx1ZSgpKTsKK30KKworYm9vbCBIVE1MQ2FudmFzRWxlbWVudDo6c2hvdWxkQWNjZWxl
cmF0ZSh1bnNpZ25lZCBhcmVhKSBjb25zdAoreworICAgIGF1dG8mIHNldHRpbmdzID0gZG9jdW1l
bnQoKS5zZXR0aW5ncygpOworCiAgICAgaWYgKGFyZWEgPiBzZXR0aW5ncy5tYXhpbXVtQWNjZWxl
cmF0ZWQyZENhbnZhc1NpemUoKSkKICAgICAgICAgcmV0dXJuIGZhbHNlOwogCiAjaWYgVVNFKElP
U1VSRkFDRV9DQU5WQVNfQkFDS0lOR19TVE9SRSkKICAgICByZXR1cm4gc2V0dGluZ3MuY2FudmFz
VXNlc0FjY2VsZXJhdGVkRHJhd2luZygpOwogI2Vsc2UKLSAgICBVTlVTRURfUEFSQU0oc2l6ZSk7
CiAgICAgcmV0dXJuIGZhbHNlOwogI2VuZGlmCiB9CkBAIC05MjcsMjcgKzkzMSwyOSBAQCB2b2lk
IEhUTUxDYW52YXNFbGVtZW50OjpjcmVhdGVJbWFnZUJ1ZmZlCiAgICAgbV9oYXNDcmVhdGVkSW1h
Z2VCdWZmZXIgPSB0cnVlOwogICAgIG1fZGlkQ2xlYXJJbWFnZUJ1ZmZlciA9IHRydWU7CiAKLSAg
ICAvLyBQZXJmb3JtIG11bHRpcGxpY2F0aW9uIGFzIGZsb2F0aW5nIHBvaW50IHRvIGF2b2lkIG92
ZXJmbG93Ci0gICAgaWYgKGZsb2F0KHdpZHRoKCkpICogaGVpZ2h0KCkgPiBtYXhDYW52YXNBcmVh
KSB7CisgICAgYXV0byBjaGVja2VkQXJlYSA9IHNpemUoKS5hcmVhPFJlY29yZE92ZXJmbG93Pigp
OworCisgICAgaWYgKGNoZWNrZWRBcmVhLmhhc092ZXJmbG93ZWQoKSB8fCBjaGVja2VkQXJlYSA+
IG1heENhbnZhc0FyZWEpIHsKICAgICAgICAgYXV0byBtZXNzYWdlID0gbWFrZVN0cmluZygiQ2Fu
dmFzIGFyZWEgZXhjZWVkcyB0aGUgbWF4aW11bSBsaW1pdCAod2lkdGggKiBoZWlnaHQgPiAiLCBt
YXhDYW52YXNBcmVhLCAiKS4iKTsKICAgICAgICAgZG9jdW1lbnQoKS5hZGRDb25zb2xlTWVzc2Fn
ZShNZXNzYWdlU291cmNlOjpKUywgTWVzc2FnZUxldmVsOjpXYXJuaW5nLCBtZXNzYWdlKTsKICAg
ICAgICAgcmV0dXJuOwogICAgIH0KLSAgICAKKwogICAgIC8vIE1ha2Ugc3VyZSB3ZSBkb24ndCB1
c2UgbW9yZSBwaXhlbCBtZW1vcnkgdGhhbiB0aGUgc3lzdGVtIGNhbiBzdXBwb3J0LgotICAgIHNp
emVfdCByZXF1ZXN0ZWRQaXhlbE1lbW9yeSA9IDQgKiB3aWR0aCgpICogaGVpZ2h0KCk7Ci0gICAg
aWYgKGFjdGl2ZVBpeGVsTWVtb3J5KCkgKyByZXF1ZXN0ZWRQaXhlbE1lbW9yeSA+IG1heEFjdGl2
ZVBpeGVsTWVtb3J5KCkpIHsKKyAgICBhdXRvIGNoZWNrZWRSZXF1ZXN0ZWRQaXhlbE1lbW9yeSA9
ICg0ICogY2hlY2tlZEFyZWEpICsgYWN0aXZlUGl4ZWxNZW1vcnkoKTsKKyAgICBpZiAoY2hlY2tl
ZFJlcXVlc3RlZFBpeGVsTWVtb3J5Lmhhc092ZXJmbG93ZWQoKSB8fCBjaGVja2VkUmVxdWVzdGVk
UGl4ZWxNZW1vcnkgPiBtYXhBY3RpdmVQaXhlbE1lbW9yeSgpKSB7CiAgICAgICAgIGF1dG8gbWVz
c2FnZSA9IG1ha2VTdHJpbmcoIlRvdGFsIGNhbnZhcyBtZW1vcnkgdXNlIGV4Y2VlZHMgdGhlIG1h
eGltdW0gbGltaXQgKCIsIG1heEFjdGl2ZVBpeGVsTWVtb3J5KCkgLyAxMDI0IC8gMTAyNCwgIiBN
QikuIik7CiAgICAgICAgIGRvY3VtZW50KCkuYWRkQ29uc29sZU1lc3NhZ2UoTWVzc2FnZVNvdXJj
ZTo6SlMsIE1lc3NhZ2VMZXZlbDo6V2FybmluZywgbWVzc2FnZSk7CiAgICAgICAgIHJldHVybjsK
ICAgICB9CiAKLSAgICBpZiAoIXdpZHRoKCkgfHwgIWhlaWdodCgpKQorICAgIHVuc2lnbmVkIGFy
ZWEgPSBjaGVja2VkQXJlYS52YWx1ZSgpOworICAgIGlmICghYXJlYSkKICAgICAgICAgcmV0dXJu
OwogCiAgICAgYXV0byBob3N0V2luZG93ID0gKGRvY3VtZW50KCkudmlldygpICYmIGRvY3VtZW50
KCkudmlldygpLT5yb290KCkpID8gZG9jdW1lbnQoKS52aWV3KCktPnJvb3QoKS0+aG9zdFdpbmRv
dygpIDogbnVsbHB0cjsKIAotICAgIGF1dG8gcmVuZGVyaW5nTW9kZSA9IHNob3VsZEFjY2VsZXJh
dGUoc2l6ZSgpKSA/IFJlbmRlcmluZ01vZGU6OkFjY2VsZXJhdGVkIDogUmVuZGVyaW5nTW9kZTo6
VW5hY2NlbGVyYXRlZDsKKyAgICBhdXRvIHJlbmRlcmluZ01vZGUgPSBzaG91bGRBY2NlbGVyYXRl
KGFyZWEpID8gUmVuZGVyaW5nTW9kZTo6QWNjZWxlcmF0ZWQgOiBSZW5kZXJpbmdNb2RlOjpVbmFj
Y2VsZXJhdGVkOwogICAgIC8vIEZJWE1FOiBBZGQgYSBuZXcgc2V0dGluZyBmb3IgRGlzcGxheUxp
c3QgZHJhd2luZyBvbiBjYW52YXMuCiAgICAgYXV0byB1c2VEaXNwbGF5TGlzdCA9IG1fdXNlc0Rp
c3BsYXlMaXN0RHJhd2luZy52YWx1ZV9vcihkb2N1bWVudCgpLnNldHRpbmdzKCkuZGlzcGxheUxp
c3REcmF3aW5nRW5hYmxlZCgpKSA/IFNob3VsZFVzZURpc3BsYXlMaXN0OjpZZXMgOiBTaG91bGRV
c2VEaXNwbGF5TGlzdDo6Tm87CiAKSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2h0bWwvSFRNTENhbnZh
c0VsZW1lbnQuaAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9odG1sL0hUTUxDYW52YXNF
bGVtZW50LmgJKHJldmlzaW9uIDI3OTg3MikKKysrIFNvdXJjZS9XZWJDb3JlL2h0bWwvSFRNTENh
bnZhc0VsZW1lbnQuaAkod29ya2luZyBjb3B5KQpAQCAtMTIzLDYgKzEyMyw3IEBAIHB1YmxpYzoK
ICAgICBTZWN1cml0eU9yaWdpbiogc2VjdXJpdHlPcmlnaW4oKSBjb25zdCBmaW5hbDsKIAogICAg
IGJvb2wgc2hvdWxkQWNjZWxlcmF0ZShjb25zdCBJbnRTaXplJikgY29uc3Q7CisgICAgYm9vbCBz
aG91bGRBY2NlbGVyYXRlKHVuc2lnbmVkIGFyZWEpIGNvbnN0OwogCiAgICAgV0VCQ09SRV9FWFBP
UlQgdm9pZCBzZXRVc2VzRGlzcGxheUxpc3REcmF3aW5nKGJvb2wpOwogICAgIFdFQkNPUkVfRVhQ
T1JUIHZvaWQgc2V0VHJhY2tzRGlzcGxheUxpc3RSZXBsYXkoYm9vbCk7Cg==
</data>

          </attachment>
      

    </bug>

</bugzilla>