Bug 215976 – [GTK] REGRESSION(r150392) insufficient space allocation results in heap corruption

• Component: WebKitGTK
• Status: RESOLVED FIXED

[Jim Mason]

The change introduced by the patch for 150392 fails to allocate enough space for the new RunLoopSource struct in the TimerBase ctor, resulting in a segmentation fault due to heap corruption:

    (gdb) bt
    #0  0x00007ffaa94e30d1 in _malloc_unlocked () at /lib/64/libc.so.1
    #1  0x00007ffaa94e2f14 in malloc () at /lib/64/libc.so.1
    #2  0x00007ffaa94caaef in calloc () at /lib/64/libc.so.1
    #3  0x00007ffaa8f90189 in g_malloc0 () at /usr/lib/64/libglib-2.0.so.0
    #4  0x00007ffaa8f864fb in g_source_new () at /usr/lib/64/libglib-2.0.so.0
    #5  0x00007ffa9edcc6f4 in WTF::RunLoop::TimerBase::TimerBase(WTF::RunLoop&) ()

[Jim Mason]

Created attachment 407537 [details]
Patch

[Carlos Garcia Campos]

Comment on attachment 407537 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=407537&action=review

Thanks!

> Source/WTF/wtf/glib/RunLoopGLib.cpp:162
> -    , m_source(adoptGRef(g_source_new(&RunLoop::s_runLoopSourceFunctions, sizeof(GSource))))
> +    , m_source(adoptGRef(g_source_new(&RunLoop::s_runLoopSourceFunctions, sizeof(RunLoopSource))))

Oops, I forgot this one.

[EWS]

Committed r266331: <https://trac.webkit.org/changeset/266331>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 407537 [details].