Bug 258755 - Undefined behavior in HashSet<CSSSelector::PseudoClassType>
Summary: Undefined behavior in HashSet<CSSSelector::PseudoClassType>
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: CSS (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Chris Dumez
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-06-30 16:19 PDT by Chris Dumez
Modified: 2023-06-30 18:49 PDT (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Dumez 2023-06-30 16:19:27 PDT
Undefined in HashSet<CSSSelector::PseudoClassType>:
```
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Volumes/Work/WebKit/OpenSource/WebKitBuild/Release/usr/local/include/wtf/RefPtr.h:75:82 in 
/Volumes/Work/WebKit/OpenSource/WebKitBuild/Release/usr/local/include/wtf/HashTable.h:301:114: runtime error: load of value 4294967295, which is not a valid value for type 'const WebCore::CSSSelector::PseudoClassType'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Volumes/Work/WebKit/OpenSource/WebKitBuild/Release/usr/local/include/wtf/HashTable.h:301:114 in 
/Volumes/Work/WebKit/OpenSource/WebKitBuild/Release/usr/local/include/wtf/HashFunctions.h:104:46: runtime error: load of value 4294967295, which is not a valid value for type 'WebCore::CSSSelector::PseudoClassType'
```

The issue is that CSSSelector is not a scoped enumeration but we use `StrongEnumHashTraits<CSSSelector::PseudoClassType>` for HashSets (in RuleFeature.h for example).
This means we end up using `std::underlying_type<CSSSelector::PseudoClassType>::max()` and `std::underlying_type<CSSSelector::PseudoClassType>::max() -1` as special HashMap values. Casting values outside the enum value range to an enumeration that is not scoped is undefined behavior.

To address the issue, I am converting CSSSelector::PseudoClassType to a scoped enumeration.
Comment 1 Chris Dumez 2023-06-30 16:21:57 PDT
Pull request: https://github.com/WebKit/WebKit/pull/15468
Comment 2 EWS 2023-06-30 18:48:28 PDT
Committed 265679@main (cacc9a183c3e): <https://commits.webkit.org/265679@main>

Reviewed commits have been landed. Closing PR #15468 and removing active labels.
Comment 3 Radar WebKit Bug Importer 2023-06-30 18:49:17 PDT
<rdar://problem/111598604>