Changeset 65031 in webkit

Timestamp:

Aug 9, 2010 6:47:42 PM (14 years ago)

Author:

eric@webkit.org

Message:

2010-08-09 Adam Barth <​abarth@webkit.org>

Reviewed by Eric Seidel.

Remove error-prone external SegementedSubstring contructor
​https://bugs.webkit.org/show_bug.cgi?id=43752

There's a lot of code that assumes that SegmentedString takes ownership
of its substrings. For example, when the HTML parser pauses and
resumes asynchronously, it could explode if SegmentedString didn't own
its substrings.

Prior to this patch, there was a constructor that let
SegmentedSubstring use an external string buffer. It turns out it was
only used in a handful of places, but I'd rather pay the memcpy of
these small strings than risk having them used after free.

• bindings/js/JSHTMLDocumentCustom.cpp: (WebCore::documentWrite):
• html/LegacyHTMLDocumentParser.cpp: (WebCore::LegacyHTMLDocumentParser::parseNonHTMLText): (WebCore::LegacyHTMLDocumentParser::scriptHandler): (WebCore::LegacyHTMLDocumentParser::parseComment):
• platform/text/SegmentedString.h: (WebCore::SegmentedString::SegmentedString):

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• bindings/js/JSHTMLDocumentCustom.cpp (modified) (1 diff)
• html/LegacyHTMLDocumentParser.cpp (modified) (3 diffs)
• platform/text/SegmentedString.h (modified) (2 diffs)

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-08-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove error-prone external SegementedSubstring contructor
+        https://bugs.webkit.org/show_bug.cgi?id=43752
+
+        There's a lot of code that assumes that SegmentedString takes ownership
+        of its substrings.  For example, when the HTML parser pauses and
+        resumes asynchronously, it could explode if SegmentedString didn't own
+        its substrings.
+
+        Prior to this patch, there was a constructor that let
+        SegmentedSubstring use an external string buffer.  It turns out it was
+        only used in a handful of places, but I'd rather pay the memcpy of
+        these small strings than risk having them used after free.
+
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::documentWrite):
+        * html/LegacyHTMLDocumentParser.cpp:
+        (WebCore::LegacyHTMLDocumentParser::parseNonHTMLText):
+        (WebCore::LegacyHTMLDocumentParser::scriptHandler):
+        (WebCore::LegacyHTMLDocumentParser::parseComment):
+        * platform/text/SegmentedString.h:
+        (WebCore::SegmentedString::SegmentedString):
+
 2010-08-09  Gavin Barraclough  <barraclough@apple.com>
 

trunk/WebCore/bindings/js/JSHTMLDocumentCustom.cpp

@@ -151 +151 @@
     }
     if (addNewline)
-        segmentedString.append(SegmentedString(&newlineCharacter, 1));
+        segmentedString.append(SegmentedString(String(&newlineCharacter, 1)));
 
     Document* activeDocument = asJSDOMWindow(exec->lexicalGlobalObject())->impl()->document();

trunk/WebCore/html/LegacyHTMLDocumentParser.cpp

@@ -347 +347 @@
                 state = scriptHandler(state);
             else {
-                state = processListing(SegmentedString(m_scriptCode, m_scriptCodeSize), state);
+                state = processListing(SegmentedString(String(m_scriptCode, m_scriptCodeSize)), state);
                 processToken();
                 if (state.inStyle()) {
@@ -452 +452 @@
     }
 
-    state = processListing(SegmentedString(m_scriptCode, m_scriptCodeSize), state);
+    state = processListing(SegmentedString(String(m_scriptCode, m_scriptCodeSize)), state);
     RefPtr<Node> node = processToken();
 
@@ -626 +626 @@
                     m_currentToken.tagName = commentAtom;
                     m_currentToken.beginTag = true;
-                    state = processListing(SegmentedString(m_scriptCode, m_scriptCodeSize - endCharsCount), state);
+                    state = processListing(SegmentedString(String(m_scriptCode, m_scriptCodeSize - endCharsCount)), state);
                     processToken();
                     m_currentToken.tagName = commentAtom;

trunk/WebCore/platform/text/SegmentedString.h

@@ -39 +39 @@
     }
 
-    SegmentedSubstring(const UChar* str, int length) : m_length(length), m_current(length == 0 ? 0 : str), m_doNotExcludeLineNumbers(true) {}
-
     void clear() { m_length = 0; m_current = 0; }
     
@@ -73 +71 @@
     SegmentedString()
         : m_pushedChar1(0), m_pushedChar2(0), m_currentChar(0), m_composite(false), m_closed(false) {}
-    SegmentedString(const UChar* str, int length) : m_pushedChar1(0), m_pushedChar2(0)
-        , m_currentString(str, length), m_currentChar(m_currentString.m_current), m_composite(false), m_closed(false) {}
     SegmentedString(const String& str)
         : m_pushedChar1(0), m_pushedChar2(0), m_currentString(str)