Title: [248369] branches/safari-608.1-branch/Source/WebCore
- Revision
- 248369
- Author
- [email protected]
- Date
- 2019-08-07 09:41:33 -0700 (Wed, 07 Aug 2019)
Log Message
Cherry-pick r248173. rdar://problem/54036774
Harden NodeRareData::m_connectedFrameCount
https://bugs.webkit.org/show_bug.cgi?id=200300
Reviewed by Geoffrey Garen.
Use unsinged integer type in NodeRareData::m_connectedFrameCount since it's padded anyway.
* dom/Node.cpp:
(WebCore::Node::decrementConnectedSubframeCount): Check that hasRareNode() is true in release builds.
* dom/NodeRareData.h:
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@248173 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Diff
Modified: branches/safari-608.1-branch/Source/WebCore/ChangeLog (248368 => 248369)
--- branches/safari-608.1-branch/Source/WebCore/ChangeLog 2019-08-07 16:23:52 UTC (rev 248368)
+++ branches/safari-608.1-branch/Source/WebCore/ChangeLog 2019-08-07 16:41:33 UTC (rev 248369)
@@ -1,3 +1,34 @@
+2019-08-07 Kocsen Chung <[email protected]>
+
+ Cherry-pick r248173. rdar://problem/54036774
+
+ Harden NodeRareData::m_connectedFrameCount
+ https://bugs.webkit.org/show_bug.cgi?id=200300
+
+ Reviewed by Geoffrey Garen.
+
+ Use unsinged integer type in NodeRareData::m_connectedFrameCount since it's padded anyway.
+
+ * dom/Node.cpp:
+ (WebCore::Node::decrementConnectedSubframeCount): Check that hasRareNode() is true in release builds.
+ * dom/NodeRareData.h:
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@248173 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-08-02 Ryosuke Niwa <[email protected]>
+
+ Harden NodeRareData::m_connectedFrameCount
+ https://bugs.webkit.org/show_bug.cgi?id=200300
+
+ Reviewed by Geoffrey Garen.
+
+ Use unsinged integer type in NodeRareData::m_connectedFrameCount since it's padded anyway.
+
+ * dom/Node.cpp:
+ (WebCore::Node::decrementConnectedSubframeCount): Check that hasRareNode() is true in release builds.
+ * dom/NodeRareData.h:
+
2019-08-06 Kocsen Chung <[email protected]>
Cherry-pick r248037. rdar://problem/54018119
Modified: branches/safari-608.1-branch/Source/WebCore/dom/Node.cpp (248368 => 248369)
--- branches/safari-608.1-branch/Source/WebCore/dom/Node.cpp 2019-08-07 16:23:52 UTC (rev 248368)
+++ branches/safari-608.1-branch/Source/WebCore/dom/Node.cpp 2019-08-07 16:41:33 UTC (rev 248369)
@@ -2554,6 +2554,9 @@
void Node::decrementConnectedSubframeCount(unsigned amount)
{
+ ASSERT(rareData());
+ if (!hasRareData())
+ return; // Defend against type confusion when the above assertion fails. See webkit.org/b/200300.
rareData()->decrementConnectedSubframeCount(amount);
}
Modified: branches/safari-608.1-branch/Source/WebCore/dom/NodeRareData.h (248368 => 248369)
--- branches/safari-608.1-branch/Source/WebCore/dom/NodeRareData.h 2019-08-07 16:23:52 UTC (rev 248368)
+++ branches/safari-608.1-branch/Source/WebCore/dom/NodeRareData.h 2019-08-07 16:41:33 UTC (rev 248369)
@@ -29,6 +29,7 @@
#include "QualifiedName.h"
#include "TagCollection.h"
#include <wtf/HashSet.h>
+#include <wtf/StdLibExtras.h>
#include <wtf/text/AtomString.h>
namespace WebCore {
@@ -319,7 +320,7 @@
#endif
private:
- unsigned m_connectedFrameCount : 10; // Must fit Page::maxNumberOfFrames.
+ unsigned m_connectedFrameCount; // Must fit Page::maxNumberOfFrames.
std::unique_ptr<NodeListsNodeData> m_nodeLists;
std::unique_ptr<NodeMutationObserverData> m_mutationObserverData;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
