RESOLVED FIXED286727
Drop use of WTF_ALLOW_UNSAFE_BUFFER_USAGE in CSSCalcTree+Parser.cpp 
https://bugs.webkit.org/show_bug.cgi?id=286727
Summary Drop use of WTF_ALLOW_UNSAFE_BUFFER_USAGE in CSSCalcTree+Parser.cpp
Chris Dumez
Reported 2025-01-29 21:00:08 PST
Drop use of WTF_ALLOW_UNSAFE_BUFFER_USAGE in CSSCalcTree+Parser.cpp.
Attachments
Add attachment proposed patch, testcase, etc.
Chris Dumez
Comment 1 2025-01-29 21:04:23 PST
Pull request: https://github.com/WebKit/WebKit/pull/39746
EWS
Comment 2 2025-01-29 22:19:32 PST
Committed 289546@main (a4af661503b7): <https://commits.webkit.org/289546@main> Reviewed commits have been landed. Closing PR #39746 and removing active labels.
Radar WebKit Bug Importer
Comment 3 2025-01-29 22:20:14 PST
<rdar://problem/143867680>
Fujii Hironori
Comment 4 2025-01-29 23:15:58 PST
289546@main added "originalTokens[tokens.begin() - originalTokens.data() - 1]" This expression accesses "originalTokens[-1]". With MS STL + Debug build, the problem crashes. > Debug Assertion Failed! > > Program: C:\webkit\wa\webkitbuild\debug\bin\WebCore.dll > File: C:\Program Files\Microsoft Visual Studio\2022\Professional\VC\Tools\MSVC\14.42.34433\include\span > Line: 454 > > Expression: span index out of range Can I revert this change?
Razvan Caliman
Comment 5 2025-01-30 06:08:31 PST
Revert in https://bugs.webkit.org/show_bug.cgi?id=286743
Chris Dumez
Comment 6 2025-01-30 07:44:25 PST
Reopened Bugzilla. Unreviewed, revert 289546@main as it introduced crashes, tracking revert in https://bugs.webkit.org/show_bug.cgi?id=286745.
Chris Dumez
Comment 7 2025-01-30 08:26:08 PST
Follow-up fix in https://commits.webkit.org/289558@main.
Note You need to log in before you can comment on or make changes to this bug.