Bug 66808 - [chromium] Fix potential nullptr deref in TiledLayerChromium::pushPropertiesTo
Summary: [chromium] Fix potential nullptr deref in TiledLayerChromium::pushPropertiesTo
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Adrienne Walker
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-08-23 14:00 PDT by Adrienne Walker
Modified: 2011-08-23 15:11 PDT (History)
2 users (show)

See Also:

Attachments
Patch (2.33 KB, patch)
2011-08-23 14:12 PDT, Adrienne Walker 		jamesr: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Adrienne Walker 2011-08-23 14:00:52 PDT 
[chromium] Fix potential nullptr deref in TiledLayerChromium::pushPropertiesTo
Comment 1 Adrienne Walker 2011-08-23 14:12:21 PDT 
Created attachment 104913 [details]
Patch
Comment 2 James Robinson 2011-08-23 14:15:17 PDT 
Comment on attachment 104913 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=104913&action=review

> Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:99
> +    if (m_skipsDraw || !m_tiler || m_tiler->isEmpty() || layerRect.isEmpty() || !layerRenderer())

this is redundant isn't it?
Comment 3 Adrienne Walker 2011-08-23 14:23:23 PDT 
(In reply to comment #2)
> (From update of attachment 104913 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=104913&action=review
> 
> > Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:99
> > +    if (m_skipsDraw || !m_tiler || m_tiler->isEmpty() || layerRect.isEmpty() || !layerRenderer())
> 
> this is redundant isn't it?

At the moment, yes, but it's only because of the convention of the caller and it's not an internal guarantee.

I think I was just looking at "Ok, what might fall down now that the tiler might be null on the impl side".

Also, it looks like m_skipsDraw isn't initialized.  :(
Comment 4 Adrienne Walker 2011-08-23 15:09:36 PDT 
Committed r93640: <http://trac.webkit.org/changeset/93640>