⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 201608 in webkit


Ignore:
Timestamp:
Jun 2, 2016, 12:05:40 PM (10 years ago)
Author:
dbates@webkit.org
Message:

Fix a couple of mistakes in CSSParserValue memory management
​https://bugs.webkit.org/show_bug.cgi?id=158307
<rdar://problem/26127225>

Source/WebCore:

Patch by Darin Adler <Darin Adler> on 2016-06-02
Reviewed by Daniel Bates.

  • css/CSSGrammar.y.in: Added a destructor for calc_func_term. This presumably

fixes some memory leaks in error cases. Removed an assertion about not needing
a call to destroy that was far too limited. Tweaked formatting of the percentage
ase in the key production. Indented calc_func_term to make it consistent with
other productions nearby.

  • css/CSSParserValues.cpp:

(WebCore::CSSParserValueList::~CSSParserValueList): Use a modern for loop.
(WebCore::CSSParserValueList::deleteValueAt): Deleted. Unused function, and also
would have resulted in a memory leak unless the code already extracted the value
from the list.
(WebCore::CSSParserValueList::extend): Properly transfer ownership from one value
list to the other by setting the unit to 0 in the donor.

  • css/CSSParserValues.h: Removed unused deleteValueAt function.

LayoutTests:

Reviewed by Darin Adler.

  • fast/css/calc-with-two-variables-crash-expected.txt: Added.
  • fast/css/calc-with-two-variables-crash.html: Added.
Location:
trunk
Files:
2 added
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r201604 r201608  
     12016-06-02  Daniel Bates  <dabates@apple.com>
     2
     3        Fix a couple of mistakes in CSSParserValue memory management
     4        https://bugs.webkit.org/show_bug.cgi?id=158307
     5        <rdar://problem/26127225>
     6
     7        Reviewed by Darin Adler.
     8
     9        * fast/css/calc-with-two-variables-crash-expected.txt: Added.
     10        * fast/css/calc-with-two-variables-crash.html: Added.
     11
    1122016-06-02  Said Abou-Hallawa  <sabouhallawa@apple.com>
    213

  • trunk/Source/WebCore/ChangeLog

    r201604 r201608  
     12016-06-02  Darin Adler  <darin@apple.com>
     2
     3        Fix a couple of mistakes in CSSParserValue memory management
     4        https://bugs.webkit.org/show_bug.cgi?id=158307
     5        <rdar://problem/26127225>
     6
     7        Reviewed by Daniel Bates.
     8
     9        * css/CSSGrammar.y.in: Added a destructor for calc_func_term. This presumably
     10        fixes some memory leaks in error cases. Removed an assertion about not needing
     11        a call to destroy that was far too limited. Tweaked formatting of the percentage
     12        ase in the key production. Indented calc_func_term to make it consistent with
     13        other productions nearby.
     14
     15        * css/CSSParserValues.cpp:
     16        (WebCore::CSSParserValueList::~CSSParserValueList): Use a modern for loop.
     17        (WebCore::CSSParserValueList::deleteValueAt): Deleted. Unused function, and also
     18        would have resulted in a memory leak unless the code already extracted the value
     19        from the list.
     20        (WebCore::CSSParserValueList::extend): Properly transfer ownership from one value
     21        list to the other by setting the unit to 0 in the donor.
     22
     23        * css/CSSParserValues.h: Removed unused deleteValueAt function.
     24
    1252016-06-02  Said Abou-Hallawa  <sabouhallawa@apple.com>
    226

  • trunk/Source/WebCore/css/CSSGrammar.y.in

    r201441 r201608  
    295295%destructor { delete $$; } keyframes_rule
    296296
    297 // These parser values never need to be destroyed because they are never functions or value lists.
    298 %type <value> calc_func_term key unary_term
    299 
    300 // These parser values need to be destroyed because they might be functions.
    301 %type <value> calc_function function variable_function min_or_max_function term
    302 %destructor { destroy($$); } calc_function function variable_function min_or_max_function term
     297// These parser values never need to be destroyed because they are never functions, value lists, or variables.
     298%type <value> key unary_term
     299
     300// These parser values need to be destroyed because they might be functions, value lists, or variables.
     301%type <value> calc_func_term calc_function function min_or_max_function term variable_function
     302%destructor { destroy($$); } calc_func_term calc_function function min_or_max_function term variable_function
    303303
    304304%type <id> property
    … …  
    838838    | key_list maybe_space ',' maybe_space key {
    839839        $$ = $1;
    840         ASSERT($5.unit != CSSParserValue::Function); // No need to call destroy.
    841840        if ($$)
    842841            $$->addValue($5);
    … …  
    845844
    846845key:
    847     maybe_unary_operator PERCENTAGE { $$.id = CSSValueInvalid; $$.isInt = false; $$.fValue = $1 * $2; $$.unit = CSSPrimitiveValue::CSS_NUMBER; }
     846    maybe_unary_operator PERCENTAGE {
     847        $$.id = CSSValueInvalid;
     848        $$.isInt = false;
     849        $$.fValue = $1 * $2;
     850        $$.unit = CSSPrimitiveValue::CSS_NUMBER;
     851    }
    848852    | IDENT {
    849853        $$.id = CSSValueInvalid;
    … …  
    18611865
    18621866calc_func_term:
    1863   unary_term
    1864   | variable_function { $$ = $1; }
    1865   | unary_operator unary_term { $$ = $2; $$.fValue *= $1; }
    1866   ;
     1867    unary_term
     1868    | unary_operator unary_term { $$ = $2; $$.fValue *= $1; }
     1869    | variable_function
     1870    ;
    18671871
    18681872/*

  • trunk/Source/WebCore/css/CSSParserValues.cpp

    r200626 r201608  
    4747CSSParserValueList::~CSSParserValueList()
    4848{
    49     for (size_t i = 0, size = m_values.size(); i < size; i++)
    50         destroy(m_values[i]);
    51 }
    52 
    53 void CSSParserValueList::addValue(const CSSParserValue& v)
    54 {
    55     m_values.append(v);
    56 }
    57 
    58 void CSSParserValueList::insertValueAt(unsigned i, const CSSParserValue& v)
    59 {
    60     m_values.insert(i, v);
    61 }
    62 
    63 void CSSParserValueList::deleteValueAt(unsigned i)
    64 {
    65     m_values.remove(i);
    66 }
    67 
    68 void CSSParserValueList::extend(CSSParserValueList& valueList)
    69 {
    70     for (unsigned int i = 0; i < valueList.size(); ++i)
    71         m_values.append(*(valueList.valueAt(i)));
     49    for (auto& value : m_values)
     50        destroy(value);
     51}
     52
     53void CSSParserValueList::addValue(const CSSParserValue& value)
     54{
     55    m_values.append(value);
     56}
     57
     58void CSSParserValueList::insertValueAt(unsigned i, const CSSParserValue& value)
     59{
     60    m_values.insert(i, value);
     61}
     62
     63void CSSParserValueList::extend(CSSParserValueList& other)
     64{
     65    for (auto& value : other.m_values) {
     66        m_values.append(value);
     67        value.unit = 0; // We moved the CSSParserValue from the other list; this acts like std::move.
     68    }
    7269}
    7370

  • trunk/Source/WebCore/css/CSSParserValues.h

    r200626 r201608  
    1919 */
    2020
    21 #ifndef CSSParserValues_h
    22 #define CSSParserValues_h
     21#pragma once
    2322
    2423#include "CSSSelector.h"
    … …  
    141140    void addValue(const CSSParserValue&);
    142141    void insertValueAt(unsigned, const CSSParserValue&);
    143     void deleteValueAt(unsigned);
    144142    void extend(CSSParserValueList&);
    145143
    … …  
    279277
    280278}
    281 
    282 #endif
Note: See TracChangeset for help on using the changeset viewer.