Title: [242893] trunk
- Revision
- 242893
- Author
- [email protected]
- Date
- 2019-03-13 11:14:21 -0700 (Wed, 13 Mar 2019)
Log Message
REGRESSION(r240634): Element::hasPointerCapture() passes a JS-controlled value directly into a HashMap as a key
https://bugs.webkit.org/show_bug.cgi?id=195683
<rdar://problem/48659950>
Reviewed by Alex Christensen.
Source/WebCore:
While PointerID is defined as int32_t, we now use int64_t as the key of the HashMap mapping PointerID to CapturingData so that we use
a value outside of the int32_t range as a safe empty and removed values, allowing any int32_t to be provided through the API for
lookup in this HashMap.
Test: pointerevents/pointer-id-crash.html
* page/PointerCaptureController.h:
LayoutTests:
Add a new test which would crash in debug builds prior to this fix.
* pointerevents/pointer-id-crash-expected.txt: Added.
* pointerevents/pointer-id-crash.html: Added.
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (242892 => 242893)
--- trunk/LayoutTests/ChangeLog 2019-03-13 18:09:00 UTC (rev 242892)
+++ trunk/LayoutTests/ChangeLog 2019-03-13 18:14:21 UTC (rev 242893)
@@ -1,3 +1,16 @@
+2019-03-13 Antoine Quint <[email protected]>
+
+ REGRESSION(r240634): Element::hasPointerCapture() passes a JS-controlled value directly into a HashMap as a key
+ https://bugs.webkit.org/show_bug.cgi?id=195683
+ <rdar://problem/48659950>
+
+ Reviewed by Alex Christensen.
+
+ Add a new test which would crash in debug builds prior to this fix.
+
+ * pointerevents/pointer-id-crash-expected.txt: Added.
+ * pointerevents/pointer-id-crash.html: Added.
+
2019-03-13 Shawn Roberts <[email protected]>
http/tests/websocket/tests/hybi/handshake-ok-with-legacy-sec-websocket-response-headers.html is a flaky failure on Mac WK2
Modified: trunk/Source/WebCore/ChangeLog (242892 => 242893)
--- trunk/Source/WebCore/ChangeLog 2019-03-13 18:09:00 UTC (rev 242892)
+++ trunk/Source/WebCore/ChangeLog 2019-03-13 18:14:21 UTC (rev 242893)
@@ -1,3 +1,19 @@
+2019-03-13 Antoine Quint <[email protected]>
+
+ REGRESSION(r240634): Element::hasPointerCapture() passes a JS-controlled value directly into a HashMap as a key
+ https://bugs.webkit.org/show_bug.cgi?id=195683
+ <rdar://problem/48659950>
+
+ Reviewed by Alex Christensen.
+
+ While PointerID is defined as int32_t, we now use int64_t as the key of the HashMap mapping PointerID to CapturingData so that we use
+ a value outside of the int32_t range as a safe empty and removed values, allowing any int32_t to be provided through the API for
+ lookup in this HashMap.
+
+ Test: pointerevents/pointer-id-crash.html
+
+ * page/PointerCaptureController.h:
+
2019-03-12 Brady Eidson <[email protected]>
Take UnboundedNetworking assertion when a file upload is in progress.
Modified: trunk/Source/WebCore/page/PointerCaptureController.h (242892 => 242893)
--- trunk/Source/WebCore/page/PointerCaptureController.h 2019-03-13 18:09:00 UTC (rev 242892)
+++ trunk/Source/WebCore/page/PointerCaptureController.h 2019-03-13 18:14:21 UTC (rev 242893)
@@ -69,7 +69,10 @@
void processPendingPointerCapture(const PointerEvent&);
Page& m_page;
- HashMap<PointerID, CapturingData> m_activePointerIdsToCapturingData;
+ // While PointerID is defined as int32_t, we use int64_t here so that we may use a value outside of the int32_t range to have safe
+ // empty and removed values, allowing any int32_t to be provided through the API for lookup in this hashmap.
+ using PointerIdToCapturingDataMap = HashMap<int64_t, CapturingData, WTF::IntHash<int64_t>, WTF::SignedWithZeroKeyHashTraits<int64_t>>;
+ PointerIdToCapturingDataMap m_activePointerIdsToCapturingData;
};
} // namespace WebCore
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
