Bug 258755

Summary: Undefined behavior in HashSet<CSSSelector::PseudoClassType>
Product: WebKit Reporter: Chris Dumez <cdumez>
Component: CSSAssignee: Chris Dumez <cdumez>
Status: RESOLVED FIXED    
Severity: Normal CC: webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   

Chris Dumez
Reported 2023-06-30 16:19:27 PDT
Undefined in HashSet<CSSSelector::PseudoClassType>: ``` SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Volumes/Work/WebKit/OpenSource/WebKitBuild/Release/usr/local/include/wtf/RefPtr.h:75:82 in /Volumes/Work/WebKit/OpenSource/WebKitBuild/Release/usr/local/include/wtf/HashTable.h:301:114: runtime error: load of value 4294967295, which is not a valid value for type 'const WebCore::CSSSelector::PseudoClassType' SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Volumes/Work/WebKit/OpenSource/WebKitBuild/Release/usr/local/include/wtf/HashTable.h:301:114 in /Volumes/Work/WebKit/OpenSource/WebKitBuild/Release/usr/local/include/wtf/HashFunctions.h:104:46: runtime error: load of value 4294967295, which is not a valid value for type 'WebCore::CSSSelector::PseudoClassType' ``` The issue is that CSSSelector is not a scoped enumeration but we use `StrongEnumHashTraits<CSSSelector::PseudoClassType>` for HashSets (in RuleFeature.h for example). This means we end up using `std::underlying_type<CSSSelector::PseudoClassType>::max()` and `std::underlying_type<CSSSelector::PseudoClassType>::max() -1` as special HashMap values. Casting values outside the enum value range to an enumeration that is not scoped is undefined behavior. To address the issue, I am converting CSSSelector::PseudoClassType to a scoped enumeration.
Attachments
Chris Dumez
Comment 1 2023-06-30 16:21:57 PDT
EWS
Comment 2 2023-06-30 18:48:28 PDT
Committed 265679@main (cacc9a183c3e): <https://commits.webkit.org/265679@main> Reviewed commits have been landed. Closing PR #15468 and removing active labels.
Radar WebKit Bug Importer
Comment 3 2023-06-30 18:49:17 PDT
Note You need to log in before you can comment on or make changes to this bug.