Changeset 30550 in webkit

Timestamp:

Feb 24, 2008, 10:44:26 AM (17 years ago)

Author:

mitz@apple.com

Message:

Reviewed by Darin Adler.

• fix ​http://bugs.webkit.org/show_bug.cgi?id=17511 REGRESSION: Reproducible crash in SegmentedSubstring::SegmentedSubstring(SegmentedSubstring const&)

• wtf/Deque.h: (WTF::::expandCapacityIfNeeded): Fixed the case where m_start and m_end are both zero but the buffer capacity is non-zero. (WTF::::prepend): Added validity checks.

Location:

trunk/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• wtf/Deque.h (modified) (3 diffs)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2008-02-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=17511
+          REGRESSION: Reproducible crash in SegmentedSubstring::SegmentedSubstring(SegmentedSubstring const&)
+
+        * wtf/Deque.h:
+        (WTF::::expandCapacityIfNeeded): Fixed the case where m_start and m_end
+        are both zero but the buffer capacity is non-zero.
+        (WTF::::prepend): Added validity checks.
+
 2008-02-23  Jan Michael Alonzo  <jmalonzo@unpluggable.com>
 

trunk/JavaScriptCore/wtf/Deque.h

@@ -370 +370 @@
             if (m_end + 1 != m_start)
                 return;
-        } else {
-            if (m_end && m_end != m_buffer.capacity() - 1)
+        } else if (m_end) {
+            if (m_end != m_buffer.capacity() - 1)
                 return;
-        }
+        } else if (m_buffer.capacity())
+            return;
+
         expandCapacity();
     }
@@ -413 +415 @@
     inline void Deque<T>::prepend(const U& value)
     {
+        checkValidity();
         expandCapacityIfNeeded();
         if (!m_start)
@@ -419 +422 @@
             --m_start;
         new (&m_buffer.buffer()[m_start]) T(value);
+        checkValidity();
     }