decompose4 return value is unchecked, leading to potentially uninitialized data.
WebCore::decompose4 returns early (false) without initializing its result argument. Various clients of this method accept the return value without checking the result, using uninitialized memory to perform blending and other calculations.
Created attachment 281289 [details]
Comment on attachment 281289 [details]
View in context: https://bugs.webkit.org/attachment.cgi?id=281289&action=review
> + memset(&result, 0, sizeof(result));
> + result.perspectiveW = 1;
> + result.scaleX = 1;
> + result.scaleY = 1;
> + result.scaleZ = 1;
Should we just give Decomposed4Type some initializers?
Created attachment 281291 [details]
Committed r202068: <http://trac.webkit.org/changeset/202068>
The test still times out a lot, can't keep tests so unstable. Will roll out.
Re-opened since this is blocked by bug 158896
Rolled out in <https://trac.webkit.org/r202195>.