Bug 258755
| Summary: | Undefined behavior in HashSet<CSSSelector::PseudoClassType> | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Chris Dumez <cdumez> |
| Component: | CSS | Assignee: | Chris Dumez <cdumez> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Chris Dumez
Undefined in HashSet<CSSSelector::PseudoClassType>:
```
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Volumes/Work/WebKit/OpenSource/WebKitBuild/Release/usr/local/include/wtf/RefPtr.h:75:82 in
/Volumes/Work/WebKit/OpenSource/WebKitBuild/Release/usr/local/include/wtf/HashTable.h:301:114: runtime error: load of value 4294967295, which is not a valid value for type 'const WebCore::CSSSelector::PseudoClassType'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Volumes/Work/WebKit/OpenSource/WebKitBuild/Release/usr/local/include/wtf/HashTable.h:301:114 in
/Volumes/Work/WebKit/OpenSource/WebKitBuild/Release/usr/local/include/wtf/HashFunctions.h:104:46: runtime error: load of value 4294967295, which is not a valid value for type 'WebCore::CSSSelector::PseudoClassType'
```
The issue is that CSSSelector is not a scoped enumeration but we use `StrongEnumHashTraits<CSSSelector::PseudoClassType>` for HashSets (in RuleFeature.h for example).
This means we end up using `std::underlying_type<CSSSelector::PseudoClassType>::max()` and `std::underlying_type<CSSSelector::PseudoClassType>::max() -1` as special HashMap values. Casting values outside the enum value range to an enumeration that is not scoped is undefined behavior.
To address the issue, I am converting CSSSelector::PseudoClassType to a scoped enumeration.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Chris Dumez
Pull request: https://github.com/WebKit/WebKit/pull/15468
EWS
Committed 265679@main (cacc9a183c3e): <https://commits.webkit.org/265679@main>
Reviewed commits have been landed. Closing PR #15468 and removing active labels.
Radar WebKit Bug Importer
<rdar://problem/111598604>