Changeset 242893 in webkit

Timestamp:

Mar 13, 2019, 11:14:21 AM (7 years ago)

Author:

graouts@webkit.org

Message:

REGRESSION(r240634): Element::hasPointerCapture() passes a JS-controlled value directly into a HashMap as a key
​https://bugs.webkit.org/show_bug.cgi?id=195683
<rdar://problem/48659950>

Reviewed by Alex Christensen.

Source/WebCore:

While PointerID is defined as int32_t, we now use int64_t as the key of the HashMap mapping PointerID to CapturingData so that we use
a value outside of the int32_t range as a safe empty and removed values, allowing any int32_t to be provided through the API for
lookup in this HashMap.

Test: pointerevents/pointer-id-crash.html

• page/PointerCaptureController.h:

LayoutTests:

Add a new test which would crash in debug builds prior to this fix.

• pointerevents/pointer-id-crash-expected.txt: Added.
• pointerevents/pointer-id-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/page/PointerCaptureController.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2019-03-13  Antoine Quint  <graouts@apple.com>
+
+        REGRESSION(r240634): Element::hasPointerCapture() passes a JS-controlled value directly into a HashMap as a key
+        https://bugs.webkit.org/show_bug.cgi?id=195683
+        <rdar://problem/48659950>
+
+        Reviewed by Alex Christensen.
+
+        Add a new test which would crash in debug builds prior to this fix.
+
+        * pointerevents/pointer-id-crash-expected.txt: Added.
+        * pointerevents/pointer-id-crash.html: Added.
+
 2019-03-13  Shawn Roberts  <sroberts@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-03-13  Antoine Quint  <graouts@apple.com>
+
+        REGRESSION(r240634): Element::hasPointerCapture() passes a JS-controlled value directly into a HashMap as a key
+        https://bugs.webkit.org/show_bug.cgi?id=195683
+        <rdar://problem/48659950>
+
+        Reviewed by Alex Christensen.
+
+        While PointerID is defined as int32_t, we now use int64_t as the key of the HashMap mapping PointerID to CapturingData so that we use
+        a value outside of the int32_t range as a safe empty and removed values, allowing any int32_t to be provided through the API for
+        lookup in this HashMap.
+
+        Test: pointerevents/pointer-id-crash.html
+
+        * page/PointerCaptureController.h:
+
 2019-03-12  Brady Eidson  <beidson@apple.com>
 

trunk/Source/WebCore/page/PointerCaptureController.h

@@ -70 +70 @@
 
     Page& m_page;
-    HashMap<PointerID, CapturingData> m_activePointerIdsToCapturingData;
+    // While PointerID is defined as int32_t, we use int64_t here so that we may use a value outside of the int32_t range to have safe
+    // empty and removed values, allowing any int32_t to be provided through the API for lookup in this hashmap.
+    using PointerIdToCapturingDataMap = HashMap<int64_t, CapturingData, WTF::IntHash<int64_t>, WTF::SignedWithZeroKeyHashTraits<int64_t>>;
+    PointerIdToCapturingDataMap m_activePointerIdsToCapturingData;
 };