Title: [275049] trunk/Source/WebCore
- Revision
- 275049
- Author
- [email protected]
- Date
- 2021-03-25 11:47:17 -0700 (Thu, 25 Mar 2021)
Log Message
Address some alignment issues found by UBSan in contentextensions code
https://bugs.webkit.org/show_bug.cgi?id=223748
Reviewed by Darin Adler.
Address some alignment issues found by UBSan in contentextensions code:
- contentextensions/SerializedNFA.h:55:20: runtime error: reference binding to misaligned address 0xnnnnnnnnn for type 'const unsigned long long', which requires 8 byte alignment
- contentextensions/NFAToDFA.cpp:254:29: runtime error: reference binding to misaligned address 0xnnnnnnnnn for type 'const unsigned long long', which requires 8 byte alignment
- contentextensions/DFABytecodeCompiler.cpp:43:5: runtime error: store to misaligned address 0xnnnnnnnnn for type 'unsigned short', which requires 2 byte alignment
Use memcpy() to store/load to/from misaligned address.
* contentextensions/DFABytecodeCompiler.cpp:
(WebCore::ContentExtensions::append):
* contentextensions/NFAToDFA.cpp:
(WebCore::ContentExtensions::epsilonClosureExcludingSelf):
(WebCore::ContentExtensions::NodeIdSetToUniqueNodeIdSetTranslator::translate):
* contentextensions/SerializedNFA.h:
(WebCore::ContentExtensions::SerializedNFA::Range::pointerAt const):
(WebCore::ContentExtensions::SerializedNFA::Range::valueAt const):
(WebCore::ContentExtensions::SerializedNFA::ConstTargetIterator::operator* const):
(WebCore::ContentExtensions::SerializedNFA::ConstTargetIterator::operator-> const):
(WebCore::ContentExtensions::SerializedNFA::ConstRangeIterator::first const):
(WebCore::ContentExtensions::SerializedNFA::ConstRangeIterator::last const):
(WebCore::ContentExtensions::SerializedNFA::ConstRangeIterator::data const):
(WebCore::ContentExtensions::SerializedNFA::ConstRangeIterator::range const):
(WebCore::ContentExtensions::SerializedNFA::transitionsForNode const):
(WebCore::ContentExtensions::SerializedNFA::Range::operator[] const): Deleted.
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (275048 => 275049)
--- trunk/Source/WebCore/ChangeLog 2021-03-25 18:20:58 UTC (rev 275048)
+++ trunk/Source/WebCore/ChangeLog 2021-03-25 18:47:17 UTC (rev 275049)
@@ -1,5 +1,36 @@
2021-03-25 Chris Dumez <[email protected]>
+ Address some alignment issues found by UBSan in contentextensions code
+ https://bugs.webkit.org/show_bug.cgi?id=223748
+
+ Reviewed by Darin Adler.
+
+ Address some alignment issues found by UBSan in contentextensions code:
+ - contentextensions/SerializedNFA.h:55:20: runtime error: reference binding to misaligned address 0xnnnnnnnnn for type 'const unsigned long long', which requires 8 byte alignment
+ - contentextensions/NFAToDFA.cpp:254:29: runtime error: reference binding to misaligned address 0xnnnnnnnnn for type 'const unsigned long long', which requires 8 byte alignment
+ - contentextensions/DFABytecodeCompiler.cpp:43:5: runtime error: store to misaligned address 0xnnnnnnnnn for type 'unsigned short', which requires 2 byte alignment
+
+ Use memcpy() to store/load to/from misaligned address.
+
+ * contentextensions/DFABytecodeCompiler.cpp:
+ (WebCore::ContentExtensions::append):
+ * contentextensions/NFAToDFA.cpp:
+ (WebCore::ContentExtensions::epsilonClosureExcludingSelf):
+ (WebCore::ContentExtensions::NodeIdSetToUniqueNodeIdSetTranslator::translate):
+ * contentextensions/SerializedNFA.h:
+ (WebCore::ContentExtensions::SerializedNFA::Range::pointerAt const):
+ (WebCore::ContentExtensions::SerializedNFA::Range::valueAt const):
+ (WebCore::ContentExtensions::SerializedNFA::ConstTargetIterator::operator* const):
+ (WebCore::ContentExtensions::SerializedNFA::ConstTargetIterator::operator-> const):
+ (WebCore::ContentExtensions::SerializedNFA::ConstRangeIterator::first const):
+ (WebCore::ContentExtensions::SerializedNFA::ConstRangeIterator::last const):
+ (WebCore::ContentExtensions::SerializedNFA::ConstRangeIterator::data const):
+ (WebCore::ContentExtensions::SerializedNFA::ConstRangeIterator::range const):
+ (WebCore::ContentExtensions::SerializedNFA::transitionsForNode const):
+ (WebCore::ContentExtensions::SerializedNFA::Range::operator[] const): Deleted.
+
+2021-03-25 Chris Dumez <[email protected]>
+
Source/WebCore/xml/parser/CharacterReferenceParserInlines.h:107:33: runtime error: signed integer overflow: 268435455 * 16 cannot be represented in type 'int'
https://bugs.webkit.org/show_bug.cgi?id=223718
Modified: trunk/Source/WebCore/contentextensions/DFABytecodeCompiler.cpp (275048 => 275049)
--- trunk/Source/WebCore/contentextensions/DFABytecodeCompiler.cpp 2021-03-25 18:20:58 UTC (rev 275048)
+++ trunk/Source/WebCore/contentextensions/DFABytecodeCompiler.cpp 2021-03-25 18:47:17 UTC (rev 275049)
@@ -40,7 +40,7 @@
inline void append(Vector<DFABytecode>& bytecode, IntType value)
{
bytecode.grow(bytecode.size() + sizeof(IntType));
- *reinterpret_cast<IntType*>(&bytecode[bytecode.size() - sizeof(IntType)]) = value;
+ memcpy(&bytecode[bytecode.size() - sizeof(IntType)], &value, sizeof(IntType));
}
inline void appendZeroes(Vector<DFABytecode>& bytecode, DFABytecodeJumpSize jumpSize)
Modified: trunk/Source/WebCore/contentextensions/NFAToDFA.cpp (275048 => 275049)
--- trunk/Source/WebCore/contentextensions/NFAToDFA.cpp 2021-03-25 18:20:58 UTC (rev 275048)
+++ trunk/Source/WebCore/contentextensions/NFAToDFA.cpp 2021-03-25 18:47:17 UTC (rev 275049)
@@ -59,10 +59,10 @@
do {
unsigned unprocessedNodeId = unprocessedNodes.takeLast();
- const auto& node = nfa.nodes()[unprocessedNodeId];
+ const auto* node = nfa.nodes().pointerAt(unprocessedNodeId);
- for (uint32_t epsilonTargetIndex = node.epsilonTransitionTargetsStart; epsilonTargetIndex < node.epsilonTransitionTargetsEnd; ++epsilonTargetIndex) {
- uint32_t targetNodeId = nfa.epsilonTransitionsTargets()[epsilonTargetIndex];
+ for (uint32_t epsilonTargetIndex = node->epsilonTransitionTargetsStart; epsilonTargetIndex < node->epsilonTransitionTargetsEnd; ++epsilonTargetIndex) {
+ uint32_t targetNodeId = nfa.epsilonTransitionsTargets().valueAt(epsilonTargetIndex);
auto addResult = closure.add(targetNodeId);
if (addResult.isNewEntry) {
unprocessedNodes.append(targetNodeId);
@@ -249,9 +249,9 @@
HashSet<uint64_t, DefaultHash<uint64_t>, WTF::UnsignedWithZeroKeyHashTraits<uint64_t>> actions;
for (unsigned nfaNodeId : source.nodeIdSet) {
- const auto& nfaNode = source.nfa.nodes()[nfaNodeId];
- for (unsigned actionIndex = nfaNode.actionStart; actionIndex < nfaNode.actionEnd; ++actionIndex)
- actions.add(source.nfa.actions()[actionIndex]);
+ const auto* nfaNode = source.nfa.nodes().pointerAt(nfaNodeId);
+ for (unsigned actionIndex = nfaNode->actionStart; actionIndex < nfaNode->actionEnd; ++actionIndex)
+ actions.add(source.nfa.actions().valueAt(actionIndex));
}
unsigned actionsStart = source.dfa.actions.size();
Modified: trunk/Source/WebCore/contentextensions/SerializedNFA.h (275048 => 275049)
--- trunk/Source/WebCore/contentextensions/SerializedNFA.h 2021-03-25 18:20:58 UTC (rev 275048)
+++ trunk/Source/WebCore/contentextensions/SerializedNFA.h 2021-03-25 18:47:17 UTC (rev 275049)
@@ -49,11 +49,18 @@
const T* begin() const { return m_begin; }
const T* end() const { return m_begin + m_size; }
size_t size() const { return m_size; }
- const T& operator[](size_t i) const
+ const T* pointerAt(size_t i) const
{
RELEASE_ASSERT(i < m_size);
- return begin()[i];
+ return begin() + i;
}
+ T valueAt(size_t i) const
+ {
+ RELEASE_ASSERT(i < m_size);
+ T value;
+ memcpy(&value, begin() + i, sizeof(T));
+ return value;
+ }
private:
const T* m_begin { nullptr };
size_t m_size { 0 };
@@ -75,8 +82,8 @@
const SerializedNFA& serializedNFA;
uint32_t position;
- const uint32_t& operator*() const { return serializedNFA.targets()[position]; }
- const uint32_t* operator->() const { return &serializedNFA.targets()[position]; }
+ uint32_t operator*() const { return serializedNFA.targets().valueAt(position); }
+ const uint32_t* operator->() const { return serializedNFA.targets().pointerAt(position); }
bool operator==(const ConstTargetIterator& other) const
{
@@ -120,24 +127,24 @@
char first() const
{
- return range().first;
+ return range()->first;
}
char last() const
{
- return range().last;
+ return range()->last;
}
IterableConstTargets data() const
{
- const ImmutableRange<char>& range = this->range();
- return { serializedNFA, range.targetStart, range.targetEnd };
+ const ImmutableRange<char>* range = this->range();
+ return { serializedNFA, range->targetStart, range->targetEnd };
};
private:
- const ImmutableRange<char>& range() const
+ const ImmutableRange<char>* range() const
{
- return serializedNFA.transitions()[position];
+ return serializedNFA.transitions().pointerAt(position);
}
};
@@ -160,8 +167,8 @@
IterableConstRange transitionsForNode(uint32_t nodeId) const
{
- const auto& node = nodes()[nodeId];
- return { *this, node.rangesStart, node.rangesEnd };
+ const auto* node = nodes().pointerAt(nodeId);
+ return { *this, node->rangesStart, node->rangesEnd };
}
private:
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
