| Summary: | [chromium] Fix potential nullptr deref in TiledLayerChromium::pushPropertiesTo | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Adrienne Walker <enne> | ||||
| Component: | New Bugs | Assignee: | Adrienne Walker <enne> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | enne, jamesr | ||||
| Priority: | P2 | ||||||
| Version: | 528+ (Nightly build) | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Attachments: |
|
||||||
|
Description
Adrienne Walker
2011-08-23 14:00:52 PDT
Created attachment 104913 [details]
Patch
Comment on attachment 104913 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=104913&action=review > Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:99 > + if (m_skipsDraw || !m_tiler || m_tiler->isEmpty() || layerRect.isEmpty() || !layerRenderer()) this is redundant isn't it? (In reply to comment #2) > (From update of attachment 104913 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=104913&action=review > > > Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:99 > > + if (m_skipsDraw || !m_tiler || m_tiler->isEmpty() || layerRect.isEmpty() || !layerRenderer()) > > this is redundant isn't it? At the moment, yes, but it's only because of the convention of the caller and it's not an internal guarantee. I think I was just looking at "Ok, what might fall down now that the tiler might be null on the impl side". Also, it looks like m_skipsDraw isn't initialized. :( Committed r93640: <http://trac.webkit.org/changeset/93640> |