decompose4 return value is unchecked, leading to potentially uninitialized data.

[Dean Jackson]

decompose4 return value is unchecked, leading to potentially uninitialized data.

[Dean Jackson]

<rdar://problem/17526268>

WebCore::decompose4 returns early (false) without initializing its result argument. Various clients of this method accept the return value without checking the result, using uninitialized memory to perform blending and other calculations.

[Dean Jackson]

Created attachment 281289 [details]
Patch

[Simon Fraser (smfr)]

Comment on attachment 281289 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=281289&action=review

> Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp:366
> +    memset(&result, 0, sizeof(result));
> +    result.perspectiveW = 1;
> +    result.scaleX = 1;
> +    result.scaleY = 1;
> +    result.scaleZ = 1;

Should we just give Decomposed4Type some initializers?

[Dean Jackson]

Created attachment 281291 [details]
Patch

[Dean Jackson]

Committed r202068: <http://trac.webkit.org/changeset/202068>

[Alexey Proskuryakov]

The test still times out a lot, can't keep tests so unstable. Will roll out.

[WebKit Commit Bot]

Re-opened since this is blocked by bug 158896

[Alexey Proskuryakov]

Rolled out in <https://trac.webkit.org/r202195>.