Bug 220710 – Validate ItemHandles when decoding them in GPUProcess

• Status: RESOLVED
• Resolution: FIXED
• Component: Layout and Rendering

[youenn fablet]

Validate ItemHandles when decoding them in GPUProcess

[youenn fablet]

Created attachment 417832 [details]
Patch

[youenn fablet]

<rdar://problem/72931549>

[youenn fablet]

Created attachment 417837 [details]
Patch

[youenn fablet]

Created attachment 417865 [details]
Patch

[Wenson Hsieh]

Comment on attachment 417865 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=417865&action=review

> Source/WebCore/platform/graphics/displaylists/DisplayListItemBuffer.cpp:543
> +template<typename, typename = void> inline constexpr bool HasIsValid = false;
> +template<typename T> inline constexpr bool HasIsValid<T, std::void_t<decltype(std::declval<T>().isValid())>> = true;

This is a really neat trick!

> Source/WebCore/platform/graphics/displaylists/DisplayListItemBuffer.cpp:559
> +bool ItemHandle::decodeInto(ItemHandle destination) const

Nit - I think the notion of "copying" is more accurate here than "decoding" (the latter of which sounds like it would involve marshaling of data to and from buffers, à la IPC encoding/decoding). Perhaps "createValidCopy" or "copyWithValidation"?

[youenn fablet]

Created attachment 418117 [details]
Patch

[youenn fablet]

Thanks for the review.

> > Source/WebCore/platform/graphics/displaylists/DisplayListItemBuffer.cpp:559
> > +bool ItemHandle::decodeInto(ItemHandle destination) const
> 
> Nit - I think the notion of "copying" is more accurate here than "decoding"
> (the latter of which sounds like it would involve marshaling of data to and
> from buffers, à la IPC encoding/decoding). Perhaps "createValidCopy" or
> "copyWithValidation"?

I changed to safeCopy

[EWS]

Committed r271741: <https://trac.webkit.org/changeset/271741>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 418117 [details].