Changeset 248369 in webkit

Timestamp:

Aug 7, 2019, 9:41:33 AM (7 years ago)

Author:

Kocsen Chung

Message:

Cherry-pick r248173. rdar://problem/54036774

Harden NodeRareData::m_connectedFrameCount
​https://bugs.webkit.org/show_bug.cgi?id=200300

Reviewed by Geoffrey Garen.

Use unsinged integer type in NodeRareData::m_connectedFrameCount since it's padded anyway.

• dom/Node.cpp: (WebCore::Node::decrementConnectedSubframeCount): Check that hasRareNode() is true in release builds.
• dom/NodeRareData.h:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@248173 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-608.1-branch/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• dom/Node.cpp (modified) (1 diff)
• dom/NodeRareData.h (modified) (2 diffs)

branches/safari-608.1-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2019-08-07  Kocsen Chung  <kocsen_chung@apple.com>
+
+        Cherry-pick r248173. rdar://problem/54036774
+
+    Harden NodeRareData::m_connectedFrameCount
+    https://bugs.webkit.org/show_bug.cgi?id=200300
+    
+    Reviewed by Geoffrey Garen.
+    
+    Use unsinged integer type in NodeRareData::m_connectedFrameCount since it's padded anyway.
+    
+    * dom/Node.cpp:
+    (WebCore::Node::decrementConnectedSubframeCount): Check that hasRareNode() is true in release builds.
+    * dom/NodeRareData.h:
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@248173 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-08-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+            Harden NodeRareData::m_connectedFrameCount
+            https://bugs.webkit.org/show_bug.cgi?id=200300
+
+            Reviewed by Geoffrey Garen.
+
+            Use unsinged integer type in NodeRareData::m_connectedFrameCount since it's padded anyway.
+
+            * dom/Node.cpp:
+            (WebCore::Node::decrementConnectedSubframeCount): Check that hasRareNode() is true in release builds.
+            * dom/NodeRareData.h:
+
 2019-08-06  Kocsen Chung  <kocsen_chung@apple.com>
 

branches/safari-608.1-branch/Source/WebCore/dom/Node.cpp

@@ -2555 +2555 @@
 void Node::decrementConnectedSubframeCount(unsigned amount)
 {
+    ASSERT(rareData());
+    if (!hasRareData())
+        return; // Defend against type confusion when the above assertion fails. See webkit.org/b/200300.
     rareData()->decrementConnectedSubframeCount(amount);
 }

branches/safari-608.1-branch/Source/WebCore/dom/NodeRareData.h

@@ -30 +30 @@
 #include "TagCollection.h"
 #include <wtf/HashSet.h>
+#include <wtf/StdLibExtras.h>
 #include <wtf/text/AtomString.h>
 
@@ -320 +321 @@
 
 private:
-    unsigned m_connectedFrameCount : 10; // Must fit Page::maxNumberOfFrames.
+    unsigned m_connectedFrameCount; // Must fit Page::maxNumberOfFrames.
 
     std::unique_ptr<NodeListsNodeData> m_nodeLists;