Changeset 248173 in webkit

Timestamp:

Aug 2, 2019, 1:07:11 PM (7 years ago)

Author:

rniwa@webkit.org

Message:

Harden NodeRareData::m_connectedFrameCount
​https://bugs.webkit.org/show_bug.cgi?id=200300

Reviewed by Geoffrey Garen.

Use unsinged integer type in NodeRareData::m_connectedFrameCount since it's padded anyway.

• dom/Node.cpp:

(WebCore::Node::decrementConnectedSubframeCount): Check that hasRareNode() is true in release builds.

• dom/NodeRareData.h:

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• dom/Node.cpp (modified) (1 diff)
• dom/NodeRareData.h (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-08-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Harden NodeRareData::m_connectedFrameCount
+        https://bugs.webkit.org/show_bug.cgi?id=200300
+
+        Reviewed by Geoffrey Garen.
+
+        Use unsinged integer type in NodeRareData::m_connectedFrameCount since it's padded anyway.
+
+        * dom/Node.cpp:
+        (WebCore::Node::decrementConnectedSubframeCount): Check that hasRareNode() is true in release builds.
+        * dom/NodeRareData.h:
+
 2019-08-02  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/WebCore/dom/Node.cpp

@@ -2555 +2555 @@
 void Node::decrementConnectedSubframeCount(unsigned amount)
 {
+    ASSERT(rareData());
+    if (!hasRareData())
+        return; // Defend against type confusion when the above assertion fails. See webkit.org/b/200300.
     rareData()->decrementConnectedSubframeCount(amount);
 }

trunk/Source/WebCore/dom/NodeRareData.h

@@ -30 +30 @@
 #include "TagCollection.h"
 #include <wtf/HashSet.h>
+#include <wtf/StdLibExtras.h>
 #include <wtf/text/AtomString.h>
 
@@ -320 +321 @@
 
 private:
-    unsigned m_connectedFrameCount : 10; // Must fit Page::maxNumberOfFrames.
+    unsigned m_connectedFrameCount; // Must fit Page::maxNumberOfFrames.
 
     std::unique_ptr<NodeListsNodeData> m_nodeLists;