<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[206635] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/206635">206635</a></dd>
<dt>Author</dt> <dd>said@apple.com</dd>
<dt>Date</dt> <dd>2016-09-30 09:01:36 -0700 (Fri, 30 Sep 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Change the MemoryCache and CachedResource adjustSize functions to take a long argument
https://bugs.webkit.org/show_bug.cgi?id=162708
<rdar://problem/28555702>
Reviewed by Brent Fulgham.
Source/WebCore:
Because the MemoryCache stores the size of the cached memory in unsigned,
two problems my happen when reporting a change in the size of the memory:
1. Signed integer overflow -- which can happen because MemoryCache::adjustSize()
takes a signed integer argument. If the allocated or the freed memory size is
larger than the maximum of a signed integer, an overflow will happen.
For the image caching code, this can be seen where the unsigned decodedSize
is casted to an integer before passing it to ImageObserver::decodedSizeChanged().
2. Unsigned integer overflow -- which can happen if the new allocated memory
size plus the currentSize exceeds the maximum of unsigned.
This can be seen in MemoryCache::adjustSize() where we add delta to m_liveSize
or m_deadSize without checking whether this addition will overflow or not. We
do not assert for overflow although we assert for underflow.
The fix for these two problems can be the following:
1. Make all the adjustSize functions all the way till MemoryCache::adjustSize()
take a signed long integer argument.
2. Do not create a NativeImagePtr for an ImageFrame if its frameBytes plus the
ImageFrameCache::decodedSize() will exceed the maximum of an unsigned integer.
* loader/cache/CachedImage.cpp:
(WebCore::CachedImage::decodedSizeChanged): Change the argument to be long. No overflow will happen when casting the argument from unsigned to long.
* loader/cache/CachedImage.h:
* loader/cache/CachedResource.cpp:
(WebCore::CachedResource::setDecodedSize): Use long integer casting when calling MemoryCache::adjustSize().
(WebCore::CachedResource::setEncodedSize): Ditto.
* loader/cache/MemoryCache.cpp:
(WebCore::MemoryCache::MemoryCache): Add as static assert to ensure sizeof(long long) can hold any unsigned or its negation.
(WebCore::MemoryCache::revalidationSucceeded): Use long integer casting when calling MemoryCache::adjustSize().
(WebCore::MemoryCache::remove): Ditto.
(WebCore::MemoryCache::adjustSize): Change the function argument to long integer. No overflow will happen when casting the argument from unsigned to long.
* loader/cache/MemoryCache.h:
* platform/graphics/ImageFrameCache.cpp:
(WebCore::ImageFrameCache::destroyIncompleteDecodedData): Call a function with its new name.
(WebCore::ImageFrameCache::decodedSizeChanged): Change the function argument to long integer. No overflow will happen when casting the argument from unsigned to long.
(WebCore::ImageFrameCache::decodedSizeIncreased): Use long integer casting when calling decodedSizeChanged().
(WebCore::ImageFrameCache::decodedSizeDecreased): Ditto.
(WebCore::ImageFrameCache::decodedSizeReset): Ditto.
(WebCore::ImageFrameCache::didDecodeProperties): Ditto.
(WebCore::ImageFrameCache::frameAtIndex): Do not create the NativeImage if adding its frameByes to the MemoryCache will cause numerical overflow.
(WebCore::ImageFrameCache::decodedSizeIncremented): Deleted. This function is renamed decodedSizeIncreased().
(WebCore::ImageFrameCache::decodedSizeDecremented): Deleted. This function is renamed decodedSizeDecreased().
* platform/graphics/ImageFrameCache.h:
* platform/graphics/ImageObserver.h:
* platform/graphics/IntSize.h:
(WebCore::IntSize::unclampedArea): Returns the area of an IntSize in size_t.
* platform/graphics/cg/PDFDocumentImage.cpp:
(WebCore::PDFDocumentImage::decodedSizeChanged): Use long integer casting when calling ImageObserver::decodedSizeChanged().
LayoutTests:
* TestExpectations: Remove failed tests.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsTestExpectations">trunk/LayoutTests/TestExpectations</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreloadercacheCachedImagecpp">trunk/Source/WebCore/loader/cache/CachedImage.cpp</a></li>
<li><a href="#trunkSourceWebCoreloadercacheCachedImageh">trunk/Source/WebCore/loader/cache/CachedImage.h</a></li>
<li><a href="#trunkSourceWebCoreloadercacheCachedResourcecpp">trunk/Source/WebCore/loader/cache/CachedResource.cpp</a></li>
<li><a href="#trunkSourceWebCoreloadercacheMemoryCachecpp">trunk/Source/WebCore/loader/cache/MemoryCache.cpp</a></li>
<li><a href="#trunkSourceWebCoreloadercacheMemoryCacheh">trunk/Source/WebCore/loader/cache/MemoryCache.h</a></li>
<li><a href="#trunkSourceWebCoreplatformgraphicsImageFrameCachecpp">trunk/Source/WebCore/platform/graphics/ImageFrameCache.cpp</a></li>
<li><a href="#trunkSourceWebCoreplatformgraphicsImageFrameCacheh">trunk/Source/WebCore/platform/graphics/ImageFrameCache.h</a></li>
<li><a href="#trunkSourceWebCoreplatformgraphicsImageObserverh">trunk/Source/WebCore/platform/graphics/ImageObserver.h</a></li>
<li><a href="#trunkSourceWebCoreplatformgraphicsIntSizeh">trunk/Source/WebCore/platform/graphics/IntSize.h</a></li>
<li><a href="#trunkSourceWebCoreplatformgraphicscgPDFDocumentImagecpp">trunk/Source/WebCore/platform/graphics/cg/PDFDocumentImage.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (206634 => 206635)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2016-09-30 14:20:25 UTC (rev 206634)
+++ trunk/LayoutTests/ChangeLog 2016-09-30 16:01:36 UTC (rev 206635)
</span><span class="lines">@@ -1,3 +1,13 @@
</span><ins>+2016-09-30 Said Abou-Hallawa <sabouhallawa@apple.com>
+
+ Change the MemoryCache and CachedResource adjustSize functions to take a long argument
+ https://bugs.webkit.org/show_bug.cgi?id=162708
+ <rdar://problem/28555702>
+
+ Reviewed by Brent Fulgham.
+
+ * TestExpectations: Remove failed tests.
+
</ins><span class="cx"> 2016-09-30 Chris Dumez <cdumez@apple.com>
</span><span class="cx">
</span><span class="cx"> Add support for ImageData.data attribute
</span></span></pre></div>
<a id="trunkLayoutTestsTestExpectations"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/TestExpectations (206634 => 206635)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/TestExpectations 2016-09-30 14:20:25 UTC (rev 206634)
+++ trunk/LayoutTests/TestExpectations 2016-09-30 16:01:36 UTC (rev 206635)
</span><span class="lines">@@ -985,18 +985,3 @@
</span><span class="cx">
</span><span class="cx"> # Only iOS has implemented lettepress.
</span><span class="cx"> fast/text/letterpress-different.html [ ImageOnlyFailure ]
</span><del>-
-webkit.org/b/162696 [ Release ] fast/images/paletted-png-with-color-profile.html [ Crash ]
-webkit.org/b/162696 [ Release ] fast/images/paint-subrect.html [ Crash ]
-webkit.org/b/162696 [ Release ] fast/images/paint-subrect-grid.html [ Crash ]
-webkit.org/b/162696 [ Release ] fast/images/pdf-as-image-crop-box.html [ Crash ]
-webkit.org/b/162696 [ Release ] fast/images/link-body-content-imageDimensionChanged-crash.html [ Crash ]
-webkit.org/b/162696 [ Release ] fast/images/object-data-url-case-insensitivity.html [ Crash ]
-webkit.org/b/162696 [ Release ] fast/images/move-image-to-new-document.html [ Crash ]
-webkit.org/b/162696 [ Release ] fast/images/pdf-as-background.html [ Crash ]
-webkit.org/b/162696 [ Release ] fast/images/pdf-as-image-landscape.html [ Crash ]
-webkit.org/b/162696 [ Release ] fast/images/pdf-as-image-with-annotations-expected.html [ Crash ]
-webkit.org/b/162696 [ Release ] fast/images/pdf-as-image-too-big.html [ Crash ]
-webkit.org/b/162696 [ Release ] fast/images/object-image.html [ Crash ]
-webkit.org/b/162696 [ Release ] fast/images/pdf-as-image-with-annotations.html [ Crash ]
-webkit.org/b/162696 [ Release ] fast/images/load-img-with-empty-src.html [ Crash ]
</del></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (206634 => 206635)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2016-09-30 14:20:25 UTC (rev 206634)
+++ trunk/Source/WebCore/ChangeLog 2016-09-30 16:01:36 UTC (rev 206635)
</span><span class="lines">@@ -1,3 +1,63 @@
</span><ins>+2016-09-30 Said Abou-Hallawa <sabouhallawa@apple.com>
+
+ Change the MemoryCache and CachedResource adjustSize functions to take a long argument
+ https://bugs.webkit.org/show_bug.cgi?id=162708
+ <rdar://problem/28555702>
+
+ Reviewed by Brent Fulgham.
+
+ Because the MemoryCache stores the size of the cached memory in unsigned,
+ two problems my happen when reporting a change in the size of the memory:
+
+ 1. Signed integer overflow -- which can happen because MemoryCache::adjustSize()
+ takes a signed integer argument. If the allocated or the freed memory size is
+ larger than the maximum of a signed integer, an overflow will happen.
+ For the image caching code, this can be seen where the unsigned decodedSize
+ is casted to an integer before passing it to ImageObserver::decodedSizeChanged().
+
+ 2. Unsigned integer overflow -- which can happen if the new allocated memory
+ size plus the currentSize exceeds the maximum of unsigned.
+ This can be seen in MemoryCache::adjustSize() where we add delta to m_liveSize
+ or m_deadSize without checking whether this addition will overflow or not. We
+ do not assert for overflow although we assert for underflow.
+
+ The fix for these two problems can be the following:
+
+ 1. Make all the adjustSize functions all the way till MemoryCache::adjustSize()
+ take a signed long integer argument.
+
+ 2. Do not create a NativeImagePtr for an ImageFrame if its frameBytes plus the
+ ImageFrameCache::decodedSize() will exceed the maximum of an unsigned integer.
+
+ * loader/cache/CachedImage.cpp:
+ (WebCore::CachedImage::decodedSizeChanged): Change the argument to be long. No overflow will happen when casting the argument from unsigned to long.
+ * loader/cache/CachedImage.h:
+ * loader/cache/CachedResource.cpp:
+ (WebCore::CachedResource::setDecodedSize): Use long integer casting when calling MemoryCache::adjustSize().
+ (WebCore::CachedResource::setEncodedSize): Ditto.
+ * loader/cache/MemoryCache.cpp:
+ (WebCore::MemoryCache::MemoryCache): Add as static assert to ensure sizeof(long long) can hold any unsigned or its negation.
+ (WebCore::MemoryCache::revalidationSucceeded): Use long integer casting when calling MemoryCache::adjustSize().
+ (WebCore::MemoryCache::remove): Ditto.
+ (WebCore::MemoryCache::adjustSize): Change the function argument to long integer. No overflow will happen when casting the argument from unsigned to long.
+ * loader/cache/MemoryCache.h:
+ * platform/graphics/ImageFrameCache.cpp:
+ (WebCore::ImageFrameCache::destroyIncompleteDecodedData): Call a function with its new name.
+ (WebCore::ImageFrameCache::decodedSizeChanged): Change the function argument to long integer. No overflow will happen when casting the argument from unsigned to long.
+ (WebCore::ImageFrameCache::decodedSizeIncreased): Use long integer casting when calling decodedSizeChanged().
+ (WebCore::ImageFrameCache::decodedSizeDecreased): Ditto.
+ (WebCore::ImageFrameCache::decodedSizeReset): Ditto.
+ (WebCore::ImageFrameCache::didDecodeProperties): Ditto.
+ (WebCore::ImageFrameCache::frameAtIndex): Do not create the NativeImage if adding its frameByes to the MemoryCache will cause numerical overflow.
+ (WebCore::ImageFrameCache::decodedSizeIncremented): Deleted. This function is renamed decodedSizeIncreased().
+ (WebCore::ImageFrameCache::decodedSizeDecremented): Deleted. This function is renamed decodedSizeDecreased().
+ * platform/graphics/ImageFrameCache.h:
+ * platform/graphics/ImageObserver.h:
+ * platform/graphics/IntSize.h:
+ (WebCore::IntSize::unclampedArea): Returns the area of an IntSize in size_t.
+ * platform/graphics/cg/PDFDocumentImage.cpp:
+ (WebCore::PDFDocumentImage::decodedSizeChanged): Use long integer casting when calling ImageObserver::decodedSizeChanged().
+
</ins><span class="cx"> 2016-09-30 Chris Dumez <cdumez@apple.com>
</span><span class="cx">
</span><span class="cx"> Add support for ImageData.data attribute
</span></span></pre></div>
<a id="trunkSourceWebCoreloadercacheCachedImagecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/cache/CachedImage.cpp (206634 => 206635)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/cache/CachedImage.cpp 2016-09-30 14:20:25 UTC (rev 206634)
+++ trunk/Source/WebCore/loader/cache/CachedImage.cpp 2016-09-30 16:01:36 UTC (rev 206635)
</span><span class="lines">@@ -450,11 +450,12 @@
</span><span class="cx"> m_image->destroyDecodedData();
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void CachedImage::decodedSizeChanged(const Image* image, int delta)
</del><ins>+void CachedImage::decodedSizeChanged(const Image* image, long long delta)
</ins><span class="cx"> {
</span><span class="cx"> if (!image || image != m_image)
</span><span class="cx"> return;
</span><del>-
</del><ins>+
+ ASSERT(delta >= 0 || decodedSize() + delta >= 0);
</ins><span class="cx"> setDecodedSize(decodedSize() + delta);
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCoreloadercacheCachedImageh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/cache/CachedImage.h (206634 => 206635)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/cache/CachedImage.h 2016-09-30 14:20:25 UTC (rev 206634)
+++ trunk/Source/WebCore/loader/cache/CachedImage.h 2016-09-30 16:01:36 UTC (rev 206635)
</span><span class="lines">@@ -118,7 +118,7 @@
</span><span class="cx"> bool stillNeedsLoad() const override { return !errorOccurred() && status() == Unknown && !isLoading(); }
</span><span class="cx">
</span><span class="cx"> // ImageObserver
</span><del>- void decodedSizeChanged(const Image*, int delta) override;
</del><ins>+ void decodedSizeChanged(const Image*, long long delta) override;
</ins><span class="cx"> void didDraw(const Image*) override;
</span><span class="cx">
</span><span class="cx"> void animationAdvanced(const Image*) override;
</span></span></pre></div>
<a id="trunkSourceWebCoreloadercacheCachedResourcecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/cache/CachedResource.cpp (206634 => 206635)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/cache/CachedResource.cpp 2016-09-30 14:20:25 UTC (rev 206634)
+++ trunk/Source/WebCore/loader/cache/CachedResource.cpp 2016-09-30 16:01:36 UTC (rev 206635)
</span><span class="lines">@@ -649,13 +649,13 @@
</span><span class="cx"> if (size == m_decodedSize)
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- int delta = size - m_decodedSize;
</del><ins>+ long long delta = static_cast<long long>(size) - m_decodedSize;
</ins><span class="cx">
</span><span class="cx"> // The object must be moved to a different queue, since its size has been changed.
</span><span class="cx"> // Remove before updating m_decodedSize, so we find the resource in the correct LRU list.
</span><span class="cx"> if (allowsCaching() && inCache())
</span><span class="cx"> MemoryCache::singleton().removeFromLRUList(*this);
</span><del>-
</del><ins>+
</ins><span class="cx"> m_decodedSize = size;
</span><span class="cx">
</span><span class="cx"> if (allowsCaching() && inCache()) {
</span><span class="lines">@@ -686,7 +686,7 @@
</span><span class="cx"> if (size == m_encodedSize)
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- int delta = size - m_encodedSize;
</del><ins>+ long long delta = static_cast<long long>(size) - m_encodedSize;
</ins><span class="cx">
</span><span class="cx"> // The object must be moved to a different queue, since its size has been changed.
</span><span class="cx"> // Remove before updating m_encodedSize, so we find the resource in the correct LRU list.
</span></span></pre></div>
<a id="trunkSourceWebCoreloadercacheMemoryCachecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/cache/MemoryCache.cpp (206634 => 206635)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/cache/MemoryCache.cpp 2016-09-30 14:20:25 UTC (rev 206634)
+++ trunk/Source/WebCore/loader/cache/MemoryCache.cpp 2016-09-30 16:01:36 UTC (rev 206635)
</span><span class="lines">@@ -71,6 +71,7 @@
</span><span class="cx"> , m_deadSize(0)
</span><span class="cx"> , m_pruneTimer(*this, &MemoryCache::prune)
</span><span class="cx"> {
</span><ins>+ static_assert(sizeof(long long) > sizeof(unsigned), "Numerical overflow can happen when adjusting the size of the cached memory.");
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> auto MemoryCache::sessionResourceMap(SessionID sessionID) const -> CachedResourceMap*
</span><span class="lines">@@ -148,7 +149,7 @@
</span><span class="cx"> resource.setInCache(true);
</span><span class="cx"> resource.updateResponseAfterRevalidation(response);
</span><span class="cx"> insertInLRUList(resource);
</span><del>- int delta = resource.size();
</del><ins>+ long long delta = resource.size();
</ins><span class="cx"> if (resource.decodedSize() && resource.hasClients())
</span><span class="cx"> insertInLiveDecodedResourcesList(resource);
</span><span class="cx"> if (delta)
</span><span class="lines">@@ -448,7 +449,7 @@
</span><span class="cx"> // Remove from the appropriate LRU list.
</span><span class="cx"> removeFromLRUList(resource);
</span><span class="cx"> removeFromLiveDecodedResourcesList(resource);
</span><del>- adjustSize(resource.hasClients(), -static_cast<int>(resource.size()));
</del><ins>+ adjustSize(resource.hasClients(), -static_cast<long long>(resource.size()));
</ins><span class="cx"> } else
</span><span class="cx"> ASSERT(resources->get(key) != &resource);
</span><span class="cx"> }
</span><span class="lines">@@ -641,13 +642,13 @@
</span><span class="cx"> m_deadSize += resource.size();
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void MemoryCache::adjustSize(bool live, int delta)
</del><ins>+void MemoryCache::adjustSize(bool live, long long delta)
</ins><span class="cx"> {
</span><span class="cx"> if (live) {
</span><del>- ASSERT(delta >= 0 || ((int)m_liveSize + delta >= 0));
</del><ins>+ ASSERT(delta >= 0 || (static_cast<long long>(m_liveSize) + delta >= 0));
</ins><span class="cx"> m_liveSize += delta;
</span><span class="cx"> } else {
</span><del>- ASSERT(delta >= 0 || ((int)m_deadSize + delta >= 0));
</del><ins>+ ASSERT(delta >= 0 || (static_cast<long long>(m_deadSize) + delta >= 0));
</ins><span class="cx"> m_deadSize += delta;
</span><span class="cx"> }
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCoreloadercacheMemoryCacheh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/cache/MemoryCache.h (206634 => 206635)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/cache/MemoryCache.h 2016-09-30 14:20:25 UTC (rev 206634)
+++ trunk/Source/WebCore/loader/cache/MemoryCache.h 2016-09-30 16:01:36 UTC (rev 206635)
</span><span class="lines">@@ -133,7 +133,7 @@
</span><span class="cx"> void removeFromLRUList(CachedResource&);
</span><span class="cx">
</span><span class="cx"> // Called to adjust the cache totals when a resource changes size.
</span><del>- void adjustSize(bool live, int delta);
</del><ins>+ void adjustSize(bool live, long long delta);
</ins><span class="cx">
</span><span class="cx"> // Track decoded resources that are in the cache and referenced by a Web page.
</span><span class="cx"> void insertInLiveDecodedResourcesList(CachedResource&);
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformgraphicsImageFrameCachecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/graphics/ImageFrameCache.cpp (206634 => 206635)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/graphics/ImageFrameCache.cpp 2016-09-30 14:20:25 UTC (rev 206634)
+++ trunk/Source/WebCore/platform/graphics/ImageFrameCache.cpp 2016-09-30 16:01:36 UTC (rev 206635)
</span><span class="lines">@@ -35,6 +35,9 @@
</span><span class="cx"> #include "ImageDecoder.h"
</span><span class="cx"> #endif
</span><span class="cx">
</span><ins>+#include <wtf/CheckedArithmetic.h>
+
+
</ins><span class="cx"> namespace WebCore {
</span><span class="cx">
</span><span class="cx"> ImageFrameCache::ImageFrameCache(Image* image)
</span><span class="lines">@@ -66,7 +69,7 @@
</span><span class="cx"> unsigned decodedSize = 0;
</span><span class="cx"> for (size_t i = 0; i < count; ++i)
</span><span class="cx"> decodedSize += m_frames[i].clearImage();
</span><del>-
</del><ins>+
</ins><span class="cx"> decodedSizeReset(decodedSize);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -93,12 +96,11 @@
</span><span class="cx">
</span><span class="cx"> decodedSize += frame.clear();
</span><span class="cx"> }
</span><del>-
- decodedSizeDecremented(decodedSize);
</del><ins>+
+ decodedSizeDecreased(decodedSize);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>-
-void ImageFrameCache::decodedSizeChanged(int decodedSize)
</del><ins>+void ImageFrameCache::decodedSizeChanged(long long decodedSize)
</ins><span class="cx"> {
</span><span class="cx"> if (!decodedSize || !m_image || !m_image->imageObserver())
</span><span class="cx"> return;
</span><span class="lines">@@ -106,7 +108,7 @@
</span><span class="cx"> m_image->imageObserver()->decodedSizeChanged(m_image, decodedSize);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void ImageFrameCache::decodedSizeIncremented(unsigned decodedSize)
</del><ins>+void ImageFrameCache::decodedSizeIncreased(unsigned decodedSize)
</ins><span class="cx"> {
</span><span class="cx"> if (!decodedSize)
</span><span class="cx"> return;
</span><span class="lines">@@ -115,19 +117,19 @@
</span><span class="cx">
</span><span class="cx"> // The fully-decoded frame will subsume the partially decoded data used
</span><span class="cx"> // to determine image properties.
</span><del>- int changeSize = decodedSize - m_decodedPropertiesSize;
</del><ins>+ long long changeSize = static_cast<long long>(decodedSize) - m_decodedPropertiesSize;
</ins><span class="cx"> m_decodedPropertiesSize = 0;
</span><span class="cx"> decodedSizeChanged(changeSize);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void ImageFrameCache::decodedSizeDecremented(unsigned decodedSize)
</del><ins>+void ImageFrameCache::decodedSizeDecreased(unsigned decodedSize)
</ins><span class="cx"> {
</span><span class="cx"> if (!decodedSize)
</span><span class="cx"> return;
</span><del>-
</del><ins>+
</ins><span class="cx"> ASSERT(m_decodedSize >= decodedSize);
</span><span class="cx"> m_decodedSize -= decodedSize;
</span><del>- decodedSizeChanged(-safeCast<int>(decodedSize));
</del><ins>+ decodedSizeChanged(-static_cast<long long>(decodedSize));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void ImageFrameCache::decodedSizeReset(unsigned decodedSize)
</span><span class="lines">@@ -134,12 +136,12 @@
</span><span class="cx"> {
</span><span class="cx"> ASSERT(m_decodedSize >= decodedSize);
</span><span class="cx"> m_decodedSize -= decodedSize;
</span><del>-
</del><ins>+
</ins><span class="cx"> // Clearing the ImageSource destroys the extra decoded data used for
</span><span class="cx"> // determining image properties.
</span><span class="cx"> decodedSize += m_decodedPropertiesSize;
</span><span class="cx"> m_decodedPropertiesSize = 0;
</span><del>- decodedSizeChanged(-safeCast<int>(decodedSize));
</del><ins>+ decodedSizeChanged(-static_cast<long long>(decodedSize));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void ImageFrameCache::didDecodeProperties(unsigned decodedPropertiesSize)
</span><span class="lines">@@ -146,8 +148,8 @@
</span><span class="cx"> {
</span><span class="cx"> if (m_decodedSize)
</span><span class="cx"> return;
</span><del>-
- int decodedSize = decodedPropertiesSize - m_decodedPropertiesSize;
</del><ins>+
+ long long decodedSize = static_cast<long long>(decodedPropertiesSize) - m_decodedPropertiesSize;
</ins><span class="cx"> m_decodedPropertiesSize = decodedPropertiesSize;
</span><span class="cx"> decodedSizeChanged(decodedSize);
</span><span class="cx"> }
</span><span class="lines">@@ -215,7 +217,7 @@
</span><span class="cx">
</span><span class="cx"> if (frame.hasInvalidNativeImage(subsamplingLevel)) {
</span><span class="cx"> unsigned decodedSize = frame.clear();
</span><del>- decodedSizeDecremented(decodedSize);
</del><ins>+ decodedSizeDecreased(decodedSize);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> if (!frame.isComplete() && caching == ImageFrame::Caching::Metadata)
</span><span class="lines">@@ -222,8 +224,13 @@
</span><span class="cx"> setFrameMetadata(index, subsamplingLevel);
</span><span class="cx">
</span><span class="cx"> if (!frame.hasNativeImage() && caching == ImageFrame::Caching::MetadataAndImage) {
</span><del>- setFrameNativeImage(m_decoder->createFrameImageAtIndex(index, subsamplingLevel), index, subsamplingLevel);
- decodedSizeIncremented(frame.frameBytes());
</del><ins>+ size_t frameBytes = size().unclampedArea() * sizeof(RGBA32);
+
+ // Do not create the NativeImage if adding its frameByes to the MemoryCache will cause numerical overflow.
+ if (WTF::isInBounds<unsigned>(frameBytes + decodedSize())) {
+ setFrameNativeImage(m_decoder->createFrameImageAtIndex(index, subsamplingLevel), index, subsamplingLevel);
+ decodedSizeIncreased(frame.frameBytes());
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> return frame;
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformgraphicsImageFrameCacheh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/graphics/ImageFrameCache.h (206634 => 206635)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/graphics/ImageFrameCache.h 2016-09-30 14:20:25 UTC (rev 206634)
+++ trunk/Source/WebCore/platform/graphics/ImageFrameCache.h 2016-09-30 16:01:36 UTC (rev 206635)
</span><span class="lines">@@ -87,10 +87,10 @@
</span><span class="cx"> T frameMetadataAtIndex(size_t index, SubsamplingLevel = SubsamplingLevel::Undefinded, ImageFrame::Caching = ImageFrame::Caching::Empty, Optional<T>* = nullptr);
</span><span class="cx">
</span><span class="cx"> bool isDecoderAvailable() const { return m_decoder; }
</span><del>- void decodedSizeChanged(int decodedSize);
</del><ins>+ void decodedSizeChanged(long long decodedSize);
</ins><span class="cx"> void didDecodeProperties(unsigned decodedPropertiesSize);
</span><del>- void decodedSizeIncremented(unsigned decodedSize);
- void decodedSizeDecremented(unsigned decodedSize);
</del><ins>+ void decodedSizeIncreased(unsigned decodedSize);
+ void decodedSizeDecreased(unsigned decodedSize);
</ins><span class="cx"> void decodedSizeReset(unsigned decodedSize);
</span><span class="cx">
</span><span class="cx"> void setNativeImage(NativeImagePtr&&);
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformgraphicsImageObserverh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/graphics/ImageObserver.h (206634 => 206635)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/graphics/ImageObserver.h 2016-09-30 14:20:25 UTC (rev 206634)
+++ trunk/Source/WebCore/platform/graphics/ImageObserver.h 2016-09-30 16:01:36 UTC (rev 206635)
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx"> protected:
</span><span class="cx"> virtual ~ImageObserver() {}
</span><span class="cx"> public:
</span><del>- virtual void decodedSizeChanged(const Image*, int delta) = 0;
</del><ins>+ virtual void decodedSizeChanged(const Image*, long long delta) = 0;
</ins><span class="cx"> virtual void didDraw(const Image*) = 0;
</span><span class="cx">
</span><span class="cx"> virtual void animationAdvanced(const Image*) = 0;
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformgraphicsIntSizeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/graphics/IntSize.h (206634 => 206635)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/graphics/IntSize.h 2016-09-30 14:20:25 UTC (rev 206634)
+++ trunk/Source/WebCore/platform/graphics/IntSize.h 2016-09-30 16:01:36 UTC (rev 206635)
</span><span class="lines">@@ -136,6 +136,11 @@
</span><span class="cx"> return abs(m_width) * abs(m_height);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ size_t unclampedArea() const
+ {
+ return static_cast<size_t>(abs(m_width)) * abs(m_height);
+ }
+
</ins><span class="cx"> int diagonalLengthSquared() const
</span><span class="cx"> {
</span><span class="cx"> return m_width * m_width + m_height * m_height;
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformgraphicscgPDFDocumentImagecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/graphics/cg/PDFDocumentImage.cpp (206634 => 206635)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/graphics/cg/PDFDocumentImage.cpp 2016-09-30 14:20:25 UTC (rev 206634)
+++ trunk/Source/WebCore/platform/graphics/cg/PDFDocumentImage.cpp 2016-09-30 16:01:36 UTC (rev 206635)
</span><span class="lines">@@ -182,7 +182,7 @@
</span><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> if (imageObserver())
</span><del>- imageObserver()->decodedSizeChanged(this, -safeCast<int>(m_cachedBytes) + newCachedBytes);
</del><ins>+ imageObserver()->decodedSizeChanged(this, -static_cast<long long>(m_cachedBytes) + newCachedBytes);
</ins><span class="cx">
</span><span class="cx"> ASSERT(s_allDecodedDataSize >= m_cachedBytes);
</span><span class="cx"> // Update with the difference in two steps to avoid unsigned underflow subtraction.
</span></span></pre>
</div>
</div>
</body>
</html>