Memory corruption in WebGLRenderingContext::simulateVertexAttrib0
<rdar://problem/21567767>
Created attachment 256244 [details] Patch
Comment on attachment 256244 [details] Patch r=me
Committed r186380: <http://trac.webkit.org/changeset/186380>
Comment on attachment 256244 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=256244&action=review > Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp:4687 > + Checked<GC3Dsizeiptr, RecordOverflow> bufferDataSize = (numVertex + 1) * 4 * sizeof(GC3Dfloat); This doesn’t start using checked arithmetic until after doing all the math. Too late!!!
OK, seems like you fixed that in http://trac.webkit.org/changeset/186384
(In reply to comment #6) > OK, seems like you fixed that in http://trac.webkit.org/changeset/186384 Yeah. It was my mistake. I found it really hard to replicate the conditions that lead to this - things failed other verification steps first. So in the end I disabled the other checks and then stepped through in the debugger to exercise the new Checked stuff.