Attachment 362059 Details for Bug 194671 – [PATCH] Proposed Fix

[patch] [PATCH] Proposed Fix

crash-1.patch (text/plain), 1.69 KB, created by Joseph Pecoraro on 2019-02-14 14:15:31 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Joseph Pecoraro

Created: 2019-02-14 14:15:31 PST

Size: 1.69 KB

patch

obsolete

>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index 650e0b43d54..ab6d3851195 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,17 @@
>+2019-02-14  Joseph Pecoraro  <pecoraro@apple.com>
>+
>+        Web Inspector: Occasional crash under WebCore::CSSStyleSheet::item called from Inspector
>+        https://bugs.webkit.org/show_bug.cgi?id=194671
>+        <rdar://problem/47628191>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * css/CSSStyleSheet.cpp:
>+        (WebCore::CSSStyleSheet::item):
>+        Make this safer to avoid overflow of the array which was the crash.
>+        Promote the assertion that would catch the lists getting out of sync
>+        in debug builds.
>+
> 2019-02-13  Joseph Pecoraro  <pecoraro@apple.com>
> 
>         Web Inspector: Crash when inspecting an element that constantly changes visibility
>diff --git a/Source/WebCore/css/CSSStyleSheet.cpp b/Source/WebCore/css/CSSStyleSheet.cpp
>index aebe97dc8f8..ab424b4aab9 100644
>--- a/Source/WebCore/css/CSSStyleSheet.cpp
>+++ b/Source/WebCore/css/CSSStyleSheet.cpp
>@@ -228,12 +228,12 @@ CSSRule* CSSStyleSheet::item(unsigned index)
> {
>     unsigned ruleCount = length();
>     if (index >= ruleCount)
>-        return 0;
>+        return nullptr;
> 
>-    if (m_childRuleCSSOMWrappers.isEmpty())
>+    ASSERT(m_childRuleCSSOMWrappers.isEmpty() || m_childRuleCSSOMWrappers.size() == ruleCount);
>+    if (m_childRuleCSSOMWrappers.size() != ruleCount)
>         m_childRuleCSSOMWrappers.grow(ruleCount);
>-    ASSERT(m_childRuleCSSOMWrappers.size() == ruleCount);
>-    
>+
>     RefPtr<CSSRule>& cssRule = m_childRuleCSSOMWrappers[index];
>     if (!cssRule)
>         cssRule = m_contents->ruleAt(index)->createCSSOMWrapper(this);

Flags:

hi: review+

Actions: View | Formatted Diff | Diff

Attachments on bug 194671: 362059 | 362066