⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 176592 in webkit


Ignore:
Timestamp:
Dec 1, 2014, 9:50:35 AM (12 years ago)
Author:
oliver@apple.com
Message:

Make sure range based iteration of Vector<> still receives bounds checking
​https://bugs.webkit.org/show_bug.cgi?id=138821

Reviewed by Mark Lam.

Source/JavaScriptCore:

There are a few uses of begin()/end() that explicitly require pointers,
so we use getPtr() to extract the underlying pointer generically.

  • bytecode/UnlinkedCodeBlock.cpp:

(JSC::UnlinkedCodeBlock::visitChildren):

  • bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitComplexPopScopes):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::emitSwitchIntJump):

  • ftl/FTLAbbreviations.h:

(JSC::FTL::mdNode):
(JSC::FTL::buildCall):

  • llint/LLIntData.cpp:

(JSC::LLInt::Data::performAssertions):

  • parser/Parser.h:

(JSC::Scope::Scope):

  • profiler/ProfileNode.cpp:

(JSC::ProfileNode::debugPrintRecursively):

  • runtime/JSArray.cpp:

(JSC::JSArray::setLengthWithArrayStorage):
(JSC::JSArray::sortCompactedVector):

  • tools/ProfileTreeNode.h:

(JSC::ProfileTreeNode::dumpInternal):

  • yarr/YarrJIT.cpp:

(JSC::Yarr::YarrGenerator::matchCharacterClass):

Source/WebCore:

There are a few uses of begin()/end() that explicitly require pointers,
so we use getPtr() to extract the underlying pointer generically.

  • bindings/js/SerializedScriptValue.cpp:

(WebCore::CloneDeserializer::deserializeString):

  • editing/TextIterator.cpp:

(WebCore::SearchBuffer::isBadMatch):

  • page/mac/ServicesOverlayController.mm:

(WebCore::ServicesOverlayController::buildSelectionHighlight):

  • platform/graphics/SegmentedFontData.cpp:

(WebCore::SegmentedFontData::fontDataForCharacter):
(WebCore::SegmentedFontData::containsCharacter):
(WebCore::SegmentedFontData::isLoading):

  • platform/graphics/WOFFFileFormat.cpp:

(WebCore::convertWOFFToSfnt):

  • rendering/RenderBox.cpp:

(WebCore::RenderBox::paintFillLayers):

  • rendering/style/GridResolvedPosition.cpp:

(WebCore::firstNamedGridLineBeforePosition):
(WebCore::GridResolvedPosition::resolveRowEndColumnEndNamedGridLinePositionAgainstOppositePosition):

  • svg/SVGFontElement.cpp:

(WebCore::kerningForPairOfStringsAndGlyphs):

  • svg/SVGPathByteStream.h:

(WebCore::SVGPathByteStream::append):

  • xml/XPathNodeSet.h:

(WebCore::XPath::NodeSet::begin):
(WebCore::XPath::NodeSet::end):

Source/WTF:

Add a new IndexedIterator struct to WTF that wraps a
Vector type and index to provide pointer like semantics
while still performing runtime bounds checking, even in
release builds. We store a simple index into the vector
which means that this iterator allows vector resizing
during iteration. If the vector is resized such that the
iterator is out of bounds, then any attempt to dereference
the iterator will crash safely. Any other errors, including
overflows, and over extending the iterator will likewise
crash.

For the purpose of retaining semantically equivalent
behaviour, the iterator can be moved to m_index == size()
as that is the standard "end" terminator for these types.
Attempting to dereference at that point will still crash
rather than perform an unsafe memory operation.

In order to maintain the validity of all the bounds checking,
we perform full integer range checking prior to any mutation
of the iterator location. If we detect an arithmetic overflow
we will crash rather than attempting to carry on.

By necessity there are many overrides for operator + and - as
we otherwise hit many different type promotion ambiguities when
performing arithmetic with iterators. These ambiguities are also
different for 32- vs. 64-bit, so duplicating the functions
and then forwarding to the core implementations that performed
the bounds checking and mutation seemed like the right call.

  • WTF.xcodeproj/project.pbxproj:
  • wtf/IndexedIterator.h: Added.

(WTF::IndexedIterator::IndexedIterator):
(WTF::IndexedIterator::operator->):
(WTF::IndexedIterator::operator*):
(WTF::IndexedIterator::get):
(WTF::IndexedIterator::operator++):
(WTF::IndexedIterator::operator--):
(WTF::IndexedIterator::operator UnspecifiedBoolType):
(WTF::IndexedIterator::operator+=):
(WTF::IndexedIterator::operator-=):
(WTF::IndexedIterator::operator+):
(WTF::IndexedIterator::operator-):
(WTF::IndexedIterator::operator=):
(WTF::IndexedIterator::operator==):
(WTF::IndexedIterator::operator!=):
(WTF::IndexedIterator::operator<):
(WTF::IndexedIterator::operator<=):
(WTF::IndexedIterator::operator>):
(WTF::IndexedIterator::operator>=):
(WTF::IndexedIterator::operator const_iterator):
(WTF::IndexedIterator::isSafeToCompare):
(WTF::IndexedIterator::unsafeGet):
(WTF::getPtr):
(WTF::operator-):
(WTF::operator==):
(WTF::operator!=):
(WTF::operator<=):
(WTF::operator>=):
(WTF::operator<):
(WTF::operator>):
(WTF::IndexedIteratorSelector::makeIterator):
(WTF::IndexedIteratorSelector::makeConstIterator):

  • wtf/RefCountedArray.h:

(WTF::RefCountedArray::RefCountedArray):

  • wtf/Vector.h:

(WTF::Vector::Vector):
(WTF::Vector::begin):
(WTF::Vector::end):
(WTF::OverflowHandler>::Vector):
(WTF::=):
(WTF::OverflowHandler>::fill):
(WTF::OverflowHandler>::expandCapacity):
(WTF::OverflowHandler>::tryExpandCapacity):
(WTF::OverflowHandler>::resize):
(WTF::OverflowHandler>::shrink):
(WTF::OverflowHandler>::grow):
(WTF::OverflowHandler>::reserveCapacity):
(WTF::OverflowHandler>::tryReserveCapacity):
(WTF::OverflowHandler>::shrinkCapacity):
(WTF::OverflowHandler>::append):
(WTF::OverflowHandler>::tryAppend):
(WTF::OverflowHandler>::appendSlowCase):
(WTF::OverflowHandler>::uncheckedAppend):
(WTF::OverflowHandler>::appendVector):
(WTF::OverflowHandler>::insert):
(WTF::OverflowHandler>::insertVector):
(WTF::OverflowHandler>::remove):

Location:
trunk/Source
Files:
1 added
29 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r176583 r176592  
     12014-11-17  Oliver Hunt  <oliver@apple.com>
     2
     3        Make sure range based iteration of Vector<> still receives bounds checking
     4        https://bugs.webkit.org/show_bug.cgi?id=138821
     5
     6        Reviewed by Mark Lam.
     7
     8        There are a few uses of begin()/end() that explicitly require pointers,
     9        so we use getPtr() to extract the underlying pointer generically.
     10
     11        * bytecode/UnlinkedCodeBlock.cpp:
     12        (JSC::UnlinkedCodeBlock::visitChildren):
     13        * bytecompiler/BytecodeGenerator.cpp:
     14        (JSC::BytecodeGenerator::emitComplexPopScopes):
     15        * dfg/DFGSpeculativeJIT.cpp:
     16        (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
     17        * ftl/FTLAbbreviations.h:
     18        (JSC::FTL::mdNode):
     19        (JSC::FTL::buildCall):
     20        * llint/LLIntData.cpp:
     21        (JSC::LLInt::Data::performAssertions):
     22        * parser/Parser.h:
     23        (JSC::Scope::Scope):
     24        * profiler/ProfileNode.cpp:
     25        (JSC::ProfileNode::debugPrintRecursively):
     26        * runtime/JSArray.cpp:
     27        (JSC::JSArray::setLengthWithArrayStorage):
     28        (JSC::JSArray::sortCompactedVector):
     29        * tools/ProfileTreeNode.h:
     30        (JSC::ProfileTreeNode::dumpInternal):
     31        * yarr/YarrJIT.cpp:
     32        (JSC::Yarr::YarrGenerator::matchCharacterClass):
     33
    1342014-11-29  Andreas Kling  <akling@apple.com>
    235

  • trunk/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp

    r172820 r176592  
    235235    visitor.append(&thisObject->m_symbolTable);
    236236    for (FunctionExpressionVector::iterator ptr = thisObject->m_functionDecls.begin(), end = thisObject->m_functionDecls.end(); ptr != end; ++ptr)
    237         visitor.append(ptr);
     237        visitor.append(WTF::getPtr(ptr));
    238238    for (FunctionExpressionVector::iterator ptr = thisObject->m_functionExprs.begin(), end = thisObject->m_functionExprs.end(); ptr != end; ++ptr)
    239         visitor.append(ptr);
     239        visitor.append(WTF::getPtr(ptr));
    240240    visitor.appendValues(thisObject->m_constantRegisters.data(), thisObject->m_constantRegisters.size());
    241241    if (thisObject->m_rareData) {

  • trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

    r176479 r176592  
    22722272            int bottomScopeIndex = -1;
    22732273            if (flipScopes) {
    2274                 topScopeIndex = topScope - m_scopeContextStack.begin();
    2275                 bottomScopeIndex = bottomScope - m_scopeContextStack.begin();
     2274                topScopeIndex = topScope - m_scopeContextStack.data();
     2275                bottomScopeIndex = bottomScope - m_scopeContextStack.data();
    22762276                savedScopeContextStack = m_scopeContextStack;
    22772277                m_scopeContextStack.shrink(finallyContext.scopeContextStackSize);
    … …  
    23172317                m_scopeContextStack = savedScopeContextStack;
    23182318                topScope = &m_scopeContextStack[topScopeIndex]; // assert it's within bounds
    2319                 bottomScope = m_scopeContextStack.begin() + bottomScopeIndex; // don't assert, since it the index might be -1.
     2319                bottomScope = m_scopeContextStack.data() + bottomScopeIndex; // don't assert, since it the index might be -1.
    23202320            }
    23212321            if (flipSwitches)

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r176109 r176592  
    49114911        m_jit.branch32(JITCompiler::AboveOrEqual, value, Imm32(table.ctiOffsets.size())),
    49124912        data->fallThrough.block);
    4913     m_jit.move(TrustedImmPtr(table.ctiOffsets.begin()), scratch);
     4913    m_jit.move(TrustedImmPtr(table.ctiOffsets.data()), scratch);
    49144914    m_jit.loadPtr(JITCompiler::BaseIndex(scratch, value, JITCompiler::timesPtr()), scratch);
    49154915    m_jit.jump(scratch);

  • trunk/Source/JavaScriptCore/ftl/FTLAbbreviations.h

    r172648 r176592  
    121121static inline LValue mdNode(LContext context, LValue* args, unsigned numArgs) { return llvm->MDNodeInContext(context, args, numArgs); }
    122122template<typename VectorType>
    123 static inline LValue mdNode(LContext context, const VectorType& vector) { return mdNode(context, const_cast<LValue*>(vector.begin()), vector.size()); }
     123static inline LValue mdNode(LContext context, const VectorType& vector) { return mdNode(context, const_cast<LValue*>(vector.data()), vector.size()); }
    124124static inline LValue mdNode(LContext context) { return mdNode(context, 0, 0); }
    125125static inline LValue mdNode(LContext context, LValue arg1) { return mdNode(context, &arg1, 1); }
    … …  
    289289inline LValue buildCall(LBuilder builder, LValue function, const VectorType& vector)
    290290{
    291     return buildCall(builder, function, vector.begin(), vector.size());
     291    return buildCall(builder, function, vector.data(), vector.size());
    292292}
    293293static inline LValue buildCall(LBuilder builder, LValue function)

  • trunk/Source/JavaScriptCore/llint/LLIntData.cpp

    r174226 r176592  
    162162    testVector.resize(42);
    163163    ASSERT(bitwise_cast<uint32_t*>(&testVector)[sizeof(void*)/sizeof(uint32_t) + 1] == 42);
    164     ASSERT(bitwise_cast<int**>(&testVector)[0] == testVector.begin());
     164    ASSERT(bitwise_cast<int**>(&testVector)[0] == testVector.data());
    165165#endif
    166166

  • trunk/Source/JavaScriptCore/parser/Parser.h

    r175396 r176592  
    131131        if (rhs.m_labels) {
    132132            m_labels = adoptPtr(new LabelStack);
    133 
    134             typedef LabelStack::const_iterator iterator;
    135             iterator end = rhs.m_labels->end();
    136             for (iterator it = rhs.m_labels->begin(); it != end; ++it)
    137                 m_labels->append(ScopeLabelInfo(it->m_ident, it->m_isLoop));
     133            for (auto label : *rhs.m_labels)
     134                m_labels->append(ScopeLabelInfo(label.m_ident, label.m_isLoop));
    138135        }
    139136    }

  • trunk/Source/JavaScriptCore/runtime/JSArray.cpp

    r173370 r176592  
    353353            // delete values in any order.
    354354            if (map->sparseMode()) {
    355                 qsort(keys.begin(), keys.size(), sizeof(unsigned), compareKeysForQSort);
     355                qsort(keys.data(), keys.size(), sizeof(unsigned), compareKeysForQSort);
    356356                unsigned i = keys.size();
    357357                while (i) {
    … …  
    11921192#if HAVE(MERGESORT)
    11931193    if (isSortingPrimitiveValues)
    1194         qsort(values.begin(), values.size(), sizeof(ValueStringPair), compareByStringPairForQSort);
     1194        qsort(values.data(), values.size(), sizeof(ValueStringPair), compareByStringPairForQSort);
    11951195    else
    1196         mergesort(values.begin(), values.size(), sizeof(ValueStringPair), compareByStringPairForQSort);
     1196        mergesort(values.data(), values.size(), sizeof(ValueStringPair), compareByStringPairForQSort);
    11971197#else
    11981198    // FIXME: The qsort library function is likely to not be a stable sort.
    11991199    // ECMAScript-262 does not specify a stable sort, but in practice, browsers perform a stable sort.
    1200     qsort(values.begin(), values.size(), sizeof(ValueStringPair), compareByStringPairForQSort);
     1200    qsort(values.data(), values.size(), sizeof(ValueStringPair), compareByStringPairForQSort);
    12011201#endif
    12021202   

  • trunk/Source/JavaScriptCore/tools/ProfileTreeNode.h

    r156438 r176592  
    8787        for (Map::iterator it = m_children->begin(); it != m_children->end(); ++it)
    8888            entries.append(&*it);
    89         qsort(entries.begin(), entries.size(), sizeof(MapEntry*), compareEntries);
     89        qsort(entries.data(), entries.size(), sizeof(MapEntry*), compareEntries);
    9090
    9191        // Iterate over the children in sample-frequency order.

  • trunk/Source/JavaScriptCore/yarr/YarrJIT.cpp

    r170876 r176592  
    224224            unsigned matchIndex = 0;
    225225            JumpList failures;
    226             matchCharacterClassRange(character, failures, matchDest, charClass->m_ranges.begin(), charClass->m_ranges.size(), &matchIndex, charClass->m_matches.begin(), charClass->m_matches.size());
     226            matchCharacterClassRange(character, failures, matchDest, charClass->m_ranges.data(), charClass->m_ranges.size(), &matchIndex, charClass->m_matches.data(), charClass->m_matches.size());
    227227            while (matchIndex < charClass->m_matches.size())
    228228                matchDest.append(branch32(Equal, character, Imm32((unsigned short)charClass->m_matches[matchIndex++])));

  • trunk/Source/WTF/ChangeLog

    r176589 r176592  
     12014-11-17  Oliver Hunt  <oliver@apple.com>
     2
     3        Make sure range based iteration of Vector<> still receives bounds checking
     4        https://bugs.webkit.org/show_bug.cgi?id=138821
     5
     6        Reviewed by Mark Lam.
     7
     8        Add a new IndexedIterator struct to WTF that wraps a
     9        Vector type and index to provide pointer like semantics
     10        while still performing runtime bounds checking, even in
     11        release builds. We store a simple index into the vector
     12        which means that this iterator allows vector resizing
     13        during iteration. If the vector is resized such that the
     14        iterator is out of bounds, then any attempt to dereference
     15        the iterator will crash safely. Any other errors, including
     16        overflows, and over extending the iterator will likewise
     17        crash.
     18
     19        For the purpose of retaining semantically equivalent
     20        behaviour, the iterator can be moved to m_index == size()
     21        as that is the standard "end" terminator for these types.
     22        Attempting to dereference at that point will still crash
     23        rather than perform an unsafe memory operation.
     24
     25        In order to maintain the validity of all the bounds checking,
     26        we perform full integer range checking prior to any mutation
     27        of the iterator location. If we detect an arithmetic overflow
     28        we will crash rather than attempting to carry on.
     29
     30        By necessity there are many overrides for operator + and - as
     31        we otherwise hit many different type promotion ambiguities when
     32        performing arithmetic with iterators. These ambiguities are also
     33        different for 32- vs. 64-bit, so duplicating the functions
     34        and then forwarding to the core implementations that performed
     35        the bounds checking and mutation seemed like the right call.
     36
     37        * WTF.xcodeproj/project.pbxproj:
     38        * wtf/IndexedIterator.h: Added.
     39        (WTF::IndexedIterator::IndexedIterator):
     40        (WTF::IndexedIterator::operator->):
     41        (WTF::IndexedIterator::operator*):
     42        (WTF::IndexedIterator::get):
     43        (WTF::IndexedIterator::operator++):
     44        (WTF::IndexedIterator::operator--):
     45        (WTF::IndexedIterator::operator UnspecifiedBoolType):
     46        (WTF::IndexedIterator::operator+=):
     47        (WTF::IndexedIterator::operator-=):
     48        (WTF::IndexedIterator::operator+):
     49        (WTF::IndexedIterator::operator-):
     50        (WTF::IndexedIterator::operator=):
     51        (WTF::IndexedIterator::operator==):
     52        (WTF::IndexedIterator::operator!=):
     53        (WTF::IndexedIterator::operator<):
     54        (WTF::IndexedIterator::operator<=):
     55        (WTF::IndexedIterator::operator>):
     56        (WTF::IndexedIterator::operator>=):
     57        (WTF::IndexedIterator::operator const_iterator):
     58        (WTF::IndexedIterator::isSafeToCompare):
     59        (WTF::IndexedIterator::unsafeGet):
     60        (WTF::getPtr):
     61        (WTF::operator-):
     62        (WTF::operator==):
     63        (WTF::operator!=):
     64        (WTF::operator<=):
     65        (WTF::operator>=):
     66        (WTF::operator<):
     67        (WTF::operator>):
     68        (WTF::IndexedIteratorSelector::makeIterator):
     69        (WTF::IndexedIteratorSelector::makeConstIterator):
     70        * wtf/RefCountedArray.h:
     71        (WTF::RefCountedArray::RefCountedArray):
     72        * wtf/Vector.h:
     73        (WTF::Vector::Vector):
     74        (WTF::Vector::begin):
     75        (WTF::Vector::end):
     76        (WTF::OverflowHandler>::Vector):
     77        (WTF::=):
     78        (WTF::OverflowHandler>::fill):
     79        (WTF::OverflowHandler>::expandCapacity):
     80        (WTF::OverflowHandler>::tryExpandCapacity):
     81        (WTF::OverflowHandler>::resize):
     82        (WTF::OverflowHandler>::shrink):
     83        (WTF::OverflowHandler>::grow):
     84        (WTF::OverflowHandler>::reserveCapacity):
     85        (WTF::OverflowHandler>::tryReserveCapacity):
     86        (WTF::OverflowHandler>::shrinkCapacity):
     87        (WTF::OverflowHandler>::append):
     88        (WTF::OverflowHandler>::tryAppend):
     89        (WTF::OverflowHandler>::appendSlowCase):
     90        (WTF::OverflowHandler>::uncheckedAppend):
     91        (WTF::OverflowHandler>::appendVector):
     92        (WTF::OverflowHandler>::insert):
     93        (WTF::OverflowHandler>::insertVector):
     94        (WTF::OverflowHandler>::remove):
     95
    1962014-11-30  Ryuan Choi  <ryuan.choi@navercorp.com>
    297

  • trunk/Source/WTF/WTF.vcxproj/WTF.vcxproj

    r175203 r176592  
    219219    <ClInclude Include="..\wtf\HashTraits.h" />
    220220    <ClInclude Include="..\wtf\HexNumber.h" />
     221    <ClInclude Include="..\wtf\IndexedIterator.h" />
    221222    <ClInclude Include="..\wtf\IteratorAdaptors.h" />
    222223    <ClInclude Include="..\wtf\IteratorRange.h" />

  • trunk/Source/WTF/WTF.vcxproj/WTF.vcxproj.filters

    r175203 r176592  
    466466    </ClInclude>
    467467    <ClInclude Include="..\wtf\HexNumber.h">
     468      <Filter>wtf</Filter>
     469    </ClInclude>
     470    <ClInclude Include="..\wtf\IndexedIterator.h">
    468471      <Filter>wtf</Filter>
    469472    </ClInclude>

  • trunk/Source/WTF/WTF.xcodeproj/project.pbxproj

    r175203 r176592  
    9999                A748745317A0BDAE00FA04CB /* SixCharacterHash.h in Headers */ = {isa = PBXBuildFile; fileRef = A748745017A0BDAE00FA04CB /* SixCharacterHash.h */; };
    100100                A748745417A0BDAE00FA04CB /* StringHashDumpContext.h in Headers */ = {isa = PBXBuildFile; fileRef = A748745117A0BDAE00FA04CB /* StringHashDumpContext.h */; };
     101                A7DC2F041A09A22D0072F4E3 /* IndexedIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = A7DC2F031A099DE30072F4E3 /* IndexedIterator.h */; };
    101102                A7E643C617C5423B003BB16B /* Compression.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7E643C417C5423B003BB16B /* Compression.cpp */; };
    102103                A7E643C717C5423B003BB16B /* Compression.h in Headers */ = {isa = PBXBuildFile; fileRef = A7E643C517C5423B003BB16B /* Compression.h */; };
    … …  
    390391                A748745017A0BDAE00FA04CB /* SixCharacterHash.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SixCharacterHash.h; sourceTree = "<group>"; };
    391392                A748745117A0BDAE00FA04CB /* StringHashDumpContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringHashDumpContext.h; sourceTree = "<group>"; };
     393                A7DC2F031A099DE30072F4E3 /* IndexedIterator.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = IndexedIterator.h; sourceTree = "<group>"; };
    392394                A7E643C417C5423B003BB16B /* Compression.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Compression.cpp; sourceTree = "<group>"; };
    393395                A7E643C517C5423B003BB16B /* Compression.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Compression.h; sourceTree = "<group>"; };
    … …  
    893895                                A8A4737A151A825B004123FF /* WTFThreadData.cpp */,
    894896                                A8A4737B151A825B004123FF /* WTFThreadData.h */,
     897                                A7DC2F031A099DE30072F4E3 /* IndexedIterator.h */,
    895898                        );
    896899                        path = wtf;
    … …  
    10661069                                A8A4745E151A825B004123FF /* CharacterNames.h in Headers */,
    10671070                                A8A47394151A825B004123FF /* CheckedArithmetic.h in Headers */,
     1071                                A7DC2F041A09A22D0072F4E3 /* IndexedIterator.h in Headers */,
    10681072                                A8A47395151A825B004123FF /* CheckedBoolean.h in Headers */,
    10691073                                A8A4745F151A825B004123FF /* Collator.h in Headers */,

  • trunk/Source/WTF/wtf/RefCountedArray.h

    r159279 r176592  
    8484        Header::fromPayload(m_data)->length = other.size();
    8585        ASSERT(Header::fromPayload(m_data)->length == other.size());
    86         VectorTypeOperations<T>::uninitializedCopy(other.begin(), other.end(), m_data);
     86        VectorTypeOperations<T>::uninitializedCopy(getPtr(other.begin()), getPtr(other.end()), m_data);
    8787    }
    8888   

  • trunk/Source/WTF/wtf/Vector.h

    r176293 r176592  
    2929#include <wtf/CheckedArithmetic.h>
    3030#include <wtf/FastMalloc.h>
     31#include <wtf/GetPtr.h>
     32#include <wtf/IndexedIterator.h>
    3133#include <wtf/MallocPtr.h>
    3234#include <wtf/Noncopyable.h>
    … …  
    555557    WTF_MAKE_FAST_ALLOCATED;
    556558private:
     559
    557560    typedef VectorBuffer<T, inlineCapacity> Base;
    558561    typedef VectorTypeOperations<T> TypeOperations;
     562    typedef IndexedIteratorSelector<Vector, OverflowHandler> IteratorSelector;
    559563
    560564public:
    561565    typedef T ValueType;
    562566
    563     typedef T* iterator;
    564     typedef const T* const_iterator;
     567    typedef typename IteratorSelector::iterator iterator;
     568    typedef typename IteratorSelector::const_iterator const_iterator;
     569
    565570    typedef std::reverse_iterator<iterator> reverse_iterator;
    566571    typedef std::reverse_iterator<const_iterator> const_reverse_iterator;
    … …  
    575580    {
    576581        if (begin())
    577             TypeOperations::initialize(begin(), end());
     582            TypeOperations::initialize(getPtr(begin()), getPtr(end()));
    578583    }
    579584
    … …  
    582587    {
    583588        if (begin())
    584             TypeOperations::uninitializedFill(begin(), end(), val);
     589            TypeOperations::uninitializedFill(getPtr(begin()), getPtr(end()), val);
    585590    }
    586591
    … …  
    646651    static ptrdiff_t dataMemoryOffset() { return Base::bufferMemoryOffset(); }
    647652
    648     iterator begin() { return data(); }
    649     iterator end() { return begin() + m_size; }
    650     const_iterator begin() const { return data(); }
    651     const_iterator end() const { return begin() + m_size; }
     653    iterator begin() { return IteratorSelector::makeIterator(*this, data()); }
     654    iterator end() { return begin() + size(); }
     655    const_iterator begin() const { return IteratorSelector::makeConstIterator(*this, data()); }
     656    const_iterator end() const { return begin() + size(); }
    652657
    653658    reverse_iterator rbegin() { return reverse_iterator(end()); }
    … …  
    684689    void clear() { shrinkCapacity(0); }
    685690
     691    void append(const_iterator, unsigned);
    686692    template<typename U> void append(const U*, unsigned);
    687693    template<typename U> void append(U&&);
    … …  
    747753{
    748754    if (begin())
    749         TypeOperations::uninitializedCopy(other.begin(), other.end(), begin());
     755        TypeOperations::uninitializedCopy(getPtr(other.begin()), getPtr(other.end()), getPtr(begin()));
    750756}
    751757
    … …  
    756762{
    757763    if (begin())
    758         TypeOperations::uninitializedCopy(other.begin(), other.end(), begin());
     764        TypeOperations::uninitializedCopy(getPtr(other.begin()), getPtr(other.end()), getPtr(begin()));
    759765}
    760766
    … …  
    773779    }
    774780   
    775     std::copy(other.begin(), other.begin() + size(), begin());
    776     TypeOperations::uninitializedCopy(other.begin() + size(), other.end(), end());
     781    std::copy(getPtr(other.begin()), getPtr(other.begin() + size()), getPtr(begin()));
     782    TypeOperations::uninitializedCopy(getPtr(other.begin() + size()), getPtr(other.end()), getPtr(end()));
    777783    m_size = other.size();
    778784
    … …  
    798804        ASSERT(begin());
    799805    }
    800    
    801     std::copy(other.begin(), other.begin() + size(), begin());
    802     TypeOperations::uninitializedCopy(other.begin() + size(), other.end(), end());
     806
     807    std::copy(getPtr(other.begin()), getPtr(other.begin() + size()), getPtr(begin()));
     808    TypeOperations::uninitializedCopy(getPtr(other.begin() + size()), getPtr(other.end()), getPtr(end()));
    803809    m_size = other.size();
    804810
    … …  
    860866    }
    861867   
    862     std::fill(begin(), end(), val);
    863     TypeOperations::uninitializedFill(end(), begin() + newSize, val);
     868    std::fill(getPtr(begin()), getPtr(end()), val);
     869    TypeOperations::uninitializedFill(getPtr(end()), getPtr(begin()) + newSize, val);
    864870    m_size = newSize;
    865871}
    … …  
    882888T* Vector<T, inlineCapacity, OverflowHandler>::expandCapacity(unsigned newMinCapacity, T* ptr)
    883889{
    884     if (ptr < begin() || ptr >= end()) {
     890    if (ptr < getPtr(begin()) || ptr >= getPtr(end())) {
    885891        expandCapacity(newMinCapacity);
    886892        return ptr;
    887893    }
    888     unsigned index = ptr - begin();
     894    unsigned index = ptr - getPtr(begin());
    889895    expandCapacity(newMinCapacity);
    890     return begin() + index;
     896    return getPtr(begin()) + index;
    891897}
    892898
    … …  
    900906const T* Vector<T, inlineCapacity, OverflowHandler>::tryExpandCapacity(unsigned newMinCapacity, const T* ptr)
    901907{
    902     if (ptr < begin() || ptr >= end()) {
     908    if (ptr < getPtr(begin()) || ptr >= getPtr(end())) {
    903909        if (!tryExpandCapacity(newMinCapacity))
    904910            return 0;
    905911        return ptr;
    906912    }
    907     unsigned index = ptr - begin();
     913    unsigned index = ptr - getPtr(begin());
    908914    if (!tryExpandCapacity(newMinCapacity))
    909915        return 0;
    910     return begin() + index;
     916    return getPtr(begin()) + index;
    911917}
    912918
    … …  
    922928{
    923929    if (size <= m_size)
    924         TypeOperations::destruct(begin() + size, end());
     930        TypeOperations::destruct(getPtr(begin()) + size, getPtr(end()));
    925931    else {
    926932        if (size > capacity())
    927933            expandCapacity(size);
    928934        if (begin())
    929             TypeOperations::initialize(end(), begin() + size);
     935            TypeOperations::initialize(getPtr(end()), getPtr(begin()) + size);
    930936    }
    931937   
    … …  
    944950{
    945951    ASSERT(size <= m_size);
    946     TypeOperations::destruct(begin() + size, end());
     952    TypeOperations::destruct(getPtr(begin()) + size, getPtr(end()));
    947953    m_size = size;
    948954}
    … …  
    955961        expandCapacity(size);
    956962    if (begin())
    957         TypeOperations::initialize(end(), begin() + size);
     963        TypeOperations::initialize(getPtr(end()), getPtr(begin()) + size);
    958964    m_size = size;
    959965}
    … …  
    964970    if (newCapacity <= capacity())
    965971        return;
    966     T* oldBuffer = begin();
    967     T* oldEnd = end();
     972    T* oldBuffer = getPtr(begin());
     973    T* oldEnd = getPtr(end());
    968974    Base::allocateBuffer(newCapacity);
    969975    ASSERT(begin());
    970     TypeOperations::move(oldBuffer, oldEnd, begin());
     976    TypeOperations::move(oldBuffer, oldEnd, getPtr(begin()));
    971977    Base::deallocateBuffer(oldBuffer);
    972978}
    … …  
    977983    if (newCapacity <= capacity())
    978984        return true;
    979     T* oldBuffer = begin();
    980     T* oldEnd = end();
     985    T* oldBuffer = getPtr(begin());
     986    T* oldEnd = getPtr(end());
    981987    if (!Base::tryAllocateBuffer(newCapacity))
    982988        return false;
    983989    ASSERT(begin());
    984     TypeOperations::move(oldBuffer, oldEnd, begin());
     990    TypeOperations::move(oldBuffer, oldEnd, getPtr(begin()));
    985991    Base::deallocateBuffer(oldBuffer);
    986992    return true;
    … …  
    10051011        shrink(newCapacity);
    10061012
    1007     T* oldBuffer = begin();
     1013    T* oldBuffer = getPtr(begin());
    10081014    if (newCapacity > 0) {
    10091015        if (Base::shouldReallocateBuffer(newCapacity)) {
    … …  
    10121018        }
    10131019
    1014         T* oldEnd = end();
     1020        T* oldEnd = getPtr(end());
    10151021        Base::allocateBuffer(newCapacity);
    1016         if (begin() != oldBuffer)
    1017             TypeOperations::move(oldBuffer, oldEnd, begin());
     1022        if (getPtr(begin()) != oldBuffer)
     1023            TypeOperations::move(oldBuffer, oldEnd, getPtr(begin()));
    10181024    }
    10191025
    … …  
    10351041    if (newSize < m_size)
    10361042        CRASH();
    1037     T* dest = end();
     1043    T* dest = getPtr(end());
    10381044    VectorCopier<std::is_trivial<T>::value, U>::uninitializedCopy(data, &data[dataSize], dest);
    10391045    m_size = newSize;
     1046}
     1047
     1048template<typename T, unsigned inlineCapacity, typename OverflowHandler>
     1049void Vector<T, inlineCapacity, OverflowHandler>::append(const_iterator data, unsigned dataSize)
     1050{
     1051    append(getPtr(data), dataSize);
    10401052}
    10411053
    … …  
    10521064    if (newSize < m_size)
    10531065        return false;
    1054     T* dest = end();
     1066    T* dest = getPtr(end());
    10551067    VectorCopier<std::is_trivial<T>::value, U>::uninitializedCopy(data, &data[dataSize], dest);
    10561068    m_size = newSize;
    … …  
    10621074{
    10631075    if (size() != capacity()) {
    1064         new (NotNull, end()) T(std::forward<U>(value));
     1076        new (NotNull, getPtr(end())) T(std::forward<U>(value));
    10651077        ++m_size;
    10661078        return;
    … …  
    10791091    ASSERT(begin());
    10801092
    1081     new (NotNull, end()) T(std::forward<U>(*ptr));
     1093    new (NotNull, getPtr(end())) T(std::forward<U>(*ptr));
    10821094    ++m_size;
    10831095}
    … …  
    10921104
    10931105    auto ptr = std::addressof(value);
    1094     new (NotNull, end()) T(std::forward<U>(*ptr));
     1106    new (NotNull, getPtr(end())) T(std::forward<U>(*ptr));
    10951107    ++m_size;
    10961108}
    … …  
    10991111inline void Vector<T, inlineCapacity, OverflowHandler>::appendVector(const Vector<U, otherCapacity>& val)
    11001112{
    1101     append(val.begin(), val.size());
     1113    append(getPtr(val.begin()), val.size());
    11021114}
    11031115
    … …  
    11131125    if (newSize < m_size)
    11141126        CRASH();
    1115     T* spot = begin() + position;
    1116     TypeOperations::moveOverlapping(spot, end(), spot + dataSize);
     1127    T* spot = getPtr(begin()) + position;
     1128    TypeOperations::moveOverlapping(spot, getPtr(end()), spot + dataSize);
    11171129    VectorCopier<std::is_trivial<T>::value, U>::uninitializedCopy(data, &data[dataSize], spot);
    11181130    m_size = newSize;
    … …  
    11301142    }
    11311143
    1132     T* spot = begin() + position;
    1133     TypeOperations::moveOverlapping(spot, end(), spot + 1);
     1144    T* spot = getPtr(begin()) + position;
     1145    TypeOperations::moveOverlapping(spot, getPtr(end()), spot + 1);
    11341146    new (NotNull, spot) T(std::forward<U>(*ptr));
    11351147    ++m_size;
    … …  
    11391151inline void Vector<T, inlineCapacity, OverflowHandler>::insertVector(unsigned position, const Vector<U, c>& val)
    11401152{
    1141     insert(position, val.begin(), val.size());
     1153    insert(position, getPtr(val.begin()), val.size());
    11421154}
    11431155
    … …  
    11461158{
    11471159    ASSERT_WITH_SECURITY_IMPLICATION(position < size());
    1148     T* spot = begin() + position;
     1160    T* spot = getPtr(begin()) + position;
    11491161    spot->~T();
    1150     TypeOperations::moveOverlapping(spot + 1, end(), spot);
     1162    TypeOperations::moveOverlapping(spot + 1, getPtr(end()), spot);
    11511163    --m_size;
    11521164}
    … …  
    11571169    ASSERT_WITH_SECURITY_IMPLICATION(position <= size());
    11581170    ASSERT_WITH_SECURITY_IMPLICATION(position + length <= size());
    1159     T* beginSpot = begin() + position;
     1171    T* beginSpot = getPtr(begin()) + position;
    11601172    T* endSpot = beginSpot + length;
    11611173    TypeOperations::destruct(beginSpot, endSpot);
    1162     TypeOperations::moveOverlapping(endSpot, end(), beginSpot);
     1174    TypeOperations::moveOverlapping(endSpot, getPtr(end()), beginSpot);
    11631175    m_size -= length;
    11641176}

  • trunk/Source/WebCore/ChangeLog

    r176585 r176592  
     12014-11-17  Oliver Hunt  <oliver@apple.com>
     2
     3        Make sure range based iteration of Vector<> still receives bounds checking
     4        https://bugs.webkit.org/show_bug.cgi?id=138821
     5
     6        Reviewed by Mark Lam.
     7
     8        There are a few uses of begin()/end() that explicitly require pointers,
     9        so we use getPtr() to extract the underlying pointer generically.
     10
     11        * bindings/js/SerializedScriptValue.cpp:
     12        (WebCore::CloneDeserializer::deserializeString):
     13        * editing/TextIterator.cpp:
     14        (WebCore::SearchBuffer::isBadMatch):
     15        * page/mac/ServicesOverlayController.mm:
     16        (WebCore::ServicesOverlayController::buildSelectionHighlight):
     17        * platform/graphics/SegmentedFontData.cpp:
     18        (WebCore::SegmentedFontData::fontDataForCharacter):
     19        (WebCore::SegmentedFontData::containsCharacter):
     20        (WebCore::SegmentedFontData::isLoading):
     21        * platform/graphics/WOFFFileFormat.cpp:
     22        (WebCore::convertWOFFToSfnt):
     23        * rendering/RenderBox.cpp:
     24        (WebCore::RenderBox::paintFillLayers):
     25        * rendering/style/GridResolvedPosition.cpp:
     26        (WebCore::firstNamedGridLineBeforePosition):
     27        (WebCore::GridResolvedPosition::resolveRowEndColumnEndNamedGridLinePositionAgainstOppositePosition):
     28        * svg/SVGFontElement.cpp:
     29        (WebCore::kerningForPairOfStringsAndGlyphs):
     30        * svg/SVGPathByteStream.h:
     31        (WebCore::SVGPathByteStream::append):
     32        * xml/XPathNodeSet.h:
     33        (WebCore::XPath::NodeSet::begin):
     34        (WebCore::XPath::NodeSet::end):
     35
    1362014-11-29  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
    237

  • trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp

    r174857 r176592  
    14381438        if (buffer.isEmpty())
    14391439            return String();
    1440         const uint8_t* ptr = buffer.begin();
    1441         const uint8_t* end = buffer.end();
     1440        const uint8_t* ptr = getPtr(buffer.begin());
     1441        const uint8_t* end = getPtr(buffer.end());
    14421442        uint32_t version;
    14431443        if (!readLittleEndian(ptr, end, version) || version > CurrentVersion)

  • trunk/Source/WebCore/editing/TextIterator.cpp

    r176293 r176592  
    20742074    normalizeCharacters(match, matchLength, m_normalizedMatch);
    20752075
    2076     const UChar* a = m_normalizedTarget.begin();
    2077     const UChar* aEnd = m_normalizedTarget.end();
    2078 
    2079     const UChar* b = m_normalizedMatch.begin();
    2080     const UChar* bEnd = m_normalizedMatch.end();
     2076    const UChar* a = getPtr(m_normalizedTarget.begin());
     2077    const UChar* aEnd = getPtr(m_normalizedTarget.end());
     2078
     2079    const UChar* b = getPtr(m_normalizedMatch.begin());
     2080    const UChar* bEnd = getPtr(m_normalizedMatch.end());
    20812081
    20822082    while (true) {

  • trunk/Source/WebCore/page/mac/ServicesOverlayController.mm

    r176459 r176592  
    556556        if (!cgRects.isEmpty()) {
    557557            CGRect visibleRect = mainFrameView->visibleContentRect();
    558             RetainPtr<DDHighlightRef> ddHighlight = adoptCF(DDHighlightCreateWithRectsInVisibleRectWithStyleAndDirection(nullptr, cgRects.begin(), cgRects.size(), visibleRect, DDHighlightNoOutlineWithArrow, YES, NSWritingDirectionNatural, NO, YES));
     558            RetainPtr<DDHighlightRef> ddHighlight = adoptCF(DDHighlightCreateWithRectsInVisibleRectWithStyleAndDirection(nullptr, cgRects.data(), cgRects.size(), visibleRect, DDHighlightNoOutlineWithArrow, YES, NSWritingDirectionNatural, NO, YES));
    559559           
    560560            newPotentialHighlights.add(Highlight::createForSelection(*this, ddHighlight, selectionRange));

  • trunk/Source/WebCore/platform/graphics/SegmentedFontData.cpp

    r165676 r176592  
    4040const SimpleFontData* SegmentedFontData::fontDataForCharacter(UChar32 c) const
    4141{
    42     Vector<FontDataRange>::const_iterator end = m_ranges.end();
    43     for (Vector<FontDataRange>::const_iterator it = m_ranges.begin(); it != end; ++it) {
     42    auto end = m_ranges.end();
     43    for (auto it = m_ranges.begin(); it != end; ++it) {
    4444        if (it->from() <= c && it->to() >= c)
    4545            return it->fontData().get();
    … …  
    5050bool SegmentedFontData::containsCharacter(UChar32 c) const
    5151{
    52     Vector<FontDataRange>::const_iterator end = m_ranges.end();
    53     for (Vector<FontDataRange>::const_iterator it = m_ranges.begin(); it != end; ++it) {
     52    auto end = m_ranges.end();
     53    for (auto it = m_ranges.begin(); it != end; ++it) {
    5454        if (c >= it->from() && c <= it->to())
    5555            return true;
    … …  
    7777bool SegmentedFontData::isLoading() const
    7878{
    79     Vector<FontDataRange>::const_iterator end = m_ranges.end();
    80     for (Vector<FontDataRange>::const_iterator it = m_ranges.begin(); it != end; ++it) {
     79    auto end = m_ranges.end();
     80    for (auto it = m_ranges.begin(); it != end; ++it) {
    8181        if (it->fontData()->isLoading())
    8282            return true;

  • trunk/Source/WebCore/platform/graphics/WOFFFileFormat.cpp

    r162875 r176592  
    201201            if (!sfnt.tryReserveCapacity(sfnt.size() + tableOrigLength))
    202202                return false;
    203             Bytef* dest = reinterpret_cast<Bytef*>(sfnt.end());
     203            Bytef* dest = reinterpret_cast<Bytef*>(getPtr(sfnt.end()));
    204204            sfnt.grow(sfnt.size() + tableOrigLength);
    205205            if (uncompress(dest, &destLen, reinterpret_cast<const Bytef*>(woff->data() + tableOffset), tableCompLength) != Z_OK)

  • trunk/Source/WebCore/platform/graphics/cairo/GradientCairo.cpp

    r165676 r176592  
    6060        m_gradient = cairo_pattern_create_linear(m_p0.x(), m_p0.y(), m_p1.x(), m_p1.y());
    6161
    62     Vector<ColorStop>::iterator stopIterator = m_stops.begin();
     62    auto stopIterator = m_stops.begin();
    6363    while (stopIterator != m_stops.end()) {
    6464        cairo_pattern_add_color_stop_rgba(m_gradient, stopIterator->stop,

  • trunk/Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp

    r165676 r176592  
    146146    // this case.
    147147    clearBeforeFrame = std::min(clearBeforeFrame, m_frameBufferCache.size() - 1);
    148     const Vector<ImageFrame>::iterator end(m_frameBufferCache.begin() + clearBeforeFrame);
     148    const auto end = m_frameBufferCache.begin() + clearBeforeFrame;
    149149
    150150    // We need to preserve frames such that:
    … …  
    166166    //     has a disposal method other than DisposeOverwritePrevious, stop
    167167    //     scanning, as we'll only need this frame when decoding the next one.
    168     Vector<ImageFrame>::iterator i(end);
     168    auto i = end;
    169169    for (; (i != m_frameBufferCache.begin()) && ((i->status() == ImageFrame::FrameEmpty) || (i->disposalMethod() == ImageFrame::DisposeOverwritePrevious)); --i) {
    170170        if ((i->status() == ImageFrame::FrameComplete) && (i != end))
    … …  
    173173
    174174    // Now |i| holds the last frame we need to preserve; clear prior frames.
    175     for (Vector<ImageFrame>::iterator j(m_frameBufferCache.begin()); j != i; ++j) {
     175    for (auto j = m_frameBufferCache.begin(); j != i; ++j) {
    176176        ASSERT(j->status() != ImageFrame::FramePartial);
    177177        if (j->status() != ImageFrame::FrameEmpty)

  • trunk/Source/WebCore/rendering/RenderBox.cpp

    r176258 r176592  
    15781578    }
    15791579
    1580     Vector<const FillLayer*>::const_reverse_iterator topLayer = layers.rend();
    1581     for (Vector<const FillLayer*>::const_reverse_iterator it = layers.rbegin(); it != topLayer; ++it)
     1580    auto topLayer = layers.rend();
     1581    for (auto it = layers.rbegin(); it != topLayer; ++it)
    15821582        paintFillLayer(paintInfo, c, *it, rect, bleedAvoidance, op, backgroundObject, baseBgColorUsage);
    15831583

  • trunk/Source/WebCore/rendering/style/GridResolvedPosition.cpp

    r176390 r176592  
    296296    // the side).
    297297    unsigned firstLineBeforePositionIndex = 0;
    298     const unsigned* firstLineBeforePosition = std::lower_bound(gridLines.begin(), gridLines.end(), position);
     298    auto firstLineBeforePosition = std::lower_bound(gridLines.begin(), gridLines.end(), position);
    299299    if (firstLineBeforePosition != gridLines.end()) {
    300300        if (*firstLineBeforePosition > position && firstLineBeforePosition != gridLines.begin())
    … …  
    317317std::unique_ptr<GridSpan> GridResolvedPosition::resolveRowEndColumnEndNamedGridLinePositionAgainstOppositePosition(const GridResolvedPosition& resolvedOppositePosition, const GridPosition& position, const Vector<unsigned>& gridLines)
    318318{
    319     ASSERT(gridLines.size());
    320319    unsigned firstLineAfterOppositePositionIndex = gridLines.size() - 1;
    321     const unsigned* firstLineAfterOppositePosition = std::upper_bound(gridLines.begin(), gridLines.end(), resolvedOppositePosition);
     320    auto firstLineAfterOppositePosition = std::upper_bound(gridLines.begin(), gridLines.end(), resolvedOppositePosition);
    322321    if (firstLineAfterOppositePosition != gridLines.end())
    323322        firstLineAfterOppositePositionIndex = firstLineAfterOppositePosition - gridLines.begin();

  • trunk/Source/WebCore/svg/SVGFontElement.cpp

    r173921 r176592  
    253253    if (!g1.isEmpty() && kerningMap.glyphMap.contains(g1)) {
    254254        SVGKerningVector* kerningVector = kerningMap.glyphMap.get(g1);
    255         SVGKerningVector::const_iterator it = kerningVector->end() - 1;
    256         const SVGKerningVector::const_iterator begin = kerningVector->begin() - 1;
    257         for (; it != begin; --it) {
    258             if (matches(u2, g2, *it))
    259                 return it->kerning;
     255        size_t it = kerningVector->size();
     256        while (it-- > 0) {
     257            auto& value = kerningVector->at(it);
     258            if (matches(u2, g2, value))
     259                return value.kerning;
    260260        }
    261261    }
    … …  
    264264        if (kerningMap.unicodeMap.contains(u1)) {
    265265            SVGKerningVector* kerningVector = kerningMap.unicodeMap.get(u1);
    266             SVGKerningVector::const_iterator it = kerningVector->end() - 1;
    267             const SVGKerningVector::const_iterator begin = kerningVector->begin() - 1;
    268             for (; it != begin; --it) {
    269                 if (matches(u2, g2, *it))
    270                     return it->kerning;
     266            size_t it = kerningVector->size();
     267            while (it-- > 0) {
     268                auto& value = kerningVector->at(it);
     269                if (matches(u2, g2, value))
     270                    return value.kerning;
    271271            }
    272272        }
    273273
    274274        if (!kerningMap.kerningUnicodeRangeMap.isEmpty()) {
    275             Vector<SVGKerningPair>::const_iterator it = kerningMap.kerningUnicodeRangeMap.end() - 1;
    276             const Vector<SVGKerningPair>::const_iterator begin = kerningMap.kerningUnicodeRangeMap.begin() - 1;
    277             for (; it != begin; --it) {
    278                 if (matches(u1, u2, g2, *it))
    279                     return it->kerning;
     275            size_t it = kerningMap.kerningUnicodeRangeMap.size();
     276            while (it-- > 0) {
     277                auto& value = kerningMap.kerningUnicodeRangeMap[it];
     278                if (matches(u1, u2, g2, value))
     279                    return value.kerning;
    280280            }
    281281        }

  • trunk/Source/WebCore/svg/SVGPathByteStream.h

    r163440 r176592  
    6161    void append(SVGPathByteStream* other)
    6262    {
    63         for (DataIterator it = other->begin(); it != other->end(); ++it)
    64             append(*it);
     63        for (auto& byte : *other)
     64            append(byte);
    6565    }
    6666    void clear() { m_data.clear(); }

  • trunk/Source/WebCore/xml/XPathNodeSet.h

    r166120 r176592  
    6565            bool subtreesAreDisjoint() const { return m_subtreesAreDisjoint || m_nodes.size() < 2; }
    6666
    67             const RefPtr<Node>* begin() const { return m_nodes.begin(); }
    68             const RefPtr<Node>* end() const { return m_nodes.end(); }
     67            const Vector<RefPtr<Node>>::iterator begin() const { return m_nodes.begin(); }
     68            const Vector<RefPtr<Node>>::iterator end() const { return m_nodes.end(); }
    6969
    7070        private:
Note: See TracChangeset for help on using the changeset viewer.