Bug 217249 – Add maximum depth check to RedBlackTree

• Component: Web Template Framework
• Status: RESOLVED FIXED

[Tadeu Zagallo]

...

[Tadeu Zagallo]

Created attachment 410368 [details]
Patch

[Tadeu Zagallo]

<rdar://problem/69432957>

[Tadeu Zagallo]

Created attachment 410377 [details]
Patch

[Mark Lam]

Comment on attachment 410377 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=410377&action=review

> Source/WTF/wtf/RedBlackTree.h:353
> +            RELEASE_ASSERT(++depth <= s_maximumTreeDepth);

I think this is wrong.  This function iterates over the set of all nodes, not the depth of the tree.  So, this check is incorrect.

[Tadeu Zagallo]

Created attachment 410532 [details]
Patch

[Tadeu Zagallo]

Created attachment 410537 [details]
Patch

[Tadeu Zagallo]

Created attachment 410592 [details]
Patch

[Saam Barati]

Comment on attachment 410592 [details]
Patch

LGTM, but  let's fix iterate with your idea of making it simpler

[Tadeu Zagallo]

Created attachment 410720 [details]
Patch

[Darin Adler]

Comment on attachment 410720 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=410720&action=review

> Source/WTF/ChangeLog:9
> +        We limit all tree traversals to 128 levels deep. That's a very conservative upper bound that

Is this a security hardening measure? What motivated the change?

[Saam Barati]

Comment on attachment 410720 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=410720&action=review

r=me

> Source/WTF/wtf/RedBlackTree.h:353
> +            RELEASE_ASSERT(++size < std::numeric_limits<unsigned>::max());

Just use Checked?

[EWS]

Committed r268135: <https://trac.webkit.org/changeset/268135>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 410720 [details].