[GTK] Off-by-one error in getStyleContext()

• Component: WebKitGTK
• Status: RESOLVED FIXED

[Michael Catanzaro]

In getStyleContext() in RenderThemeGtk.cpp:

GtkWidgetPath* path = gtk_widget_path_new();
gtk_widget_path_append_type(path, widgetType);
// ...
gtk_widget_path_iter_add_class(path, 0, GTK_STYLE_CLASS_BUTTON);
gtk_widget_path_iter_add_class(path, 1, "text-button");

Only one widget type was appended to the widget path, so the maximum valid index is 0. This code means to add both style classes to the first widget type in the widget path.

This caused no bug in practice, because when the index is invalid, gtk_widget_path_iter_add_class() automatically changes the index to the last valid position in the widget path -- in this case, 0.

[Michael Catanzaro]

Created attachment 266010 [details]
Patch

[Carlos Garcia Campos]

Comment on attachment 266010 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=266010&action=review

Good catch, thanks!

> Source/WebCore/rendering/RenderThemeGtk.cpp:178
> -        gtk_widget_path_iter_add_class(path, 1, "text-button");
> +        gtk_widget_path_iter_add_class(path, 0, "text-button");

I guess I understood this as the position of the class, rather than the widget at the given position. Since we always add one widget only, maybe it would be less confusing to use -1 in all cases.

[Michael Catanzaro]

Now that I understand how the API works, using 0 seems better to me; I would use -1 when I don't know how long the widget path is.

[WebKit Commit Bot]

Comment on attachment 266010 [details]
Patch

Clearing flags on attachment: 266010

Committed r192724: <http://trac.webkit.org/changeset/192724>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.