43270 2010-07-30 14:13:53 -0700 WebBackForwardList::backListAsImmutableArrayWithLimit() can return array with bogus items if limit is large 2010-07-30 15:39:18 -0700 1 1 1 Unclassified WebKit WebKit2 528+ (Nightly build) PC OS X 10.5 RESOLVED FIXED P2 Normal --- 1 adachan adachan sullivan oldest_to_newest 258375 0 adachan 2010-07-30 14:13:53 -0700 In one example, we pass in max size_t value as the limit, and the line unsigned i = std::max<int>(m_current - limit, 0) returns a positive integer that's >= m_current, when we expect it to be 0. 258392 1 63103 adachan 2010-07-30 14:42:12 -0700 Created attachment 63103 Patch 258424 2 63103 sullivan 2010-07-30 15:36:36 -0700 Comment on attachment 63103 Patch Much cleaner. 258426 3 adachan 2010-07-30 15:39:18 -0700 Fixed in r64381. 63103 2010-07-30 14:42:12 -0700 2010-07-30 15:36:36 -0700 Patch 43270.patch.txt text/plain 1630 adachan SW5kZXg6IFdlYktpdDIvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYktpdDIvQ2hhbmdlTG9n CShyZXZpc2lvbiA2NDM3NCkKKysrIFdlYktpdDIvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTMgQEAKKzIwMTAtMDctMzAgIEFkYSBDaGFuICA8YWRhY2hhbkBhcHBsZS5jb20+ CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgRml4IGlz c3VlIHdpdGggcG9wdWxhdGluZyB0aGUgYmFjayBsaXN0IHdoZW4gbGltaXQgaXMgYSBodWdlIG51 bWJlci4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTQz MjcwCisKKyAgICAgICAgKiBVSVByb2Nlc3MvV2ViQmFja0ZvcndhcmRMaXN0LmNwcDoKKyAgICAg ICAgKFdlYktpdDo6V2ViQmFja0ZvcndhcmRMaXN0OjpiYWNrTGlzdEFzSW1tdXRhYmxlQXJyYXlX aXRoTGltaXQpOgorCiAyMDEwLTA3LTMwICBBbmRlcnMgQ2FybHNzb24gIDxhbmRlcnNjYUBhcHBs ZS5jb20+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgU2FtIFdlaW5pZy4KSW5kZXg6IFdlYktpdDIv VUlQcm9jZXNzL1dlYkJhY2tGb3J3YXJkTGlzdC5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViS2l0Mi9V SVByb2Nlc3MvV2ViQmFja0ZvcndhcmRMaXN0LmNwcAkocmV2aXNpb24gNjQzNzQpCisrKyBXZWJL aXQyL1VJUHJvY2Vzcy9XZWJCYWNrRm9yd2FyZExpc3QuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0x ODAsMTIgKzE4MCwxNCBAQCBzdGF0aWMgdm9pZCB3ZWJCYWNrRm9yd2FyZExpc3RJdGVtRGVyZWYo CiAKIFBhc3NSZWZQdHI8SW1tdXRhYmxlQXJyYXk+IFdlYkJhY2tGb3J3YXJkTGlzdDo6YmFja0xp c3RBc0ltbXV0YWJsZUFycmF5V2l0aExpbWl0KHVuc2lnbmVkIGxpbWl0KQogewotICAgIHVuc2ln bmVkIHNpemUgPSBzdGQ6Om1pbihzdGF0aWNfY2FzdDx1bnNpZ25lZD4oYmFja0xpc3RDb3VudCgp KSwgbGltaXQpOworICAgIHVuc2lnbmVkIGJhY2tMaXN0U2l6ZSA9IHN0YXRpY19jYXN0PHVuc2ln bmVkPihiYWNrTGlzdENvdW50KCkpOworICAgIHVuc2lnbmVkIHNpemUgPSBzdGQ6Om1pbihiYWNr TGlzdFNpemUsIGxpbWl0KTsKICAgICBpZiAoIXNpemUpCiAgICAgICAgIHJldHVybiBJbW11dGFi bGVBcnJheTo6Y3JlYXRlKCk7CiAKICAgICB2b2lkKiogYXJyYXkgPSBuZXcgdm9pZCpbc2l6ZV07 Ci0gICAgZm9yICh1bnNpZ25lZCBpID0gc3RkOjptYXg8aW50PihtX2N1cnJlbnQgLSBsaW1pdCwg MCksIGogPSAwOyBpIDwgbV9jdXJyZW50OyArK2ksICsraikgeworICAgIEFTU0VSVChiYWNrTGlz dFNpemUgPj0gc2l6ZSk7CisgICAgZm9yICh1bnNpZ25lZCBpID0gYmFja0xpc3RTaXplIC0gc2l6 ZSwgaiA9IDA7IGkgPCBiYWNrTGlzdFNpemU7ICsraSwgKytqKSB7CiAgICAgICAgIFdlYkJhY2tG b3J3YXJkTGlzdEl0ZW0qIGl0ZW0gPSBtX2VudHJpZXNbaV0uZ2V0KCk7CiAgICAgICAgIGl0ZW0t PnJlZigpOwogICAgICAgICBhcnJheVtqXSA9IGl0ZW07Cg==