<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[210198] releases/WebKitGTK/webkit-2.14</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/210198">210198</a></dd>
<dt>Author</dt> <dd>carlosgc@webkit.org</dd>
<dt>Date</dt> <dd>2016-12-28 04:15:48 -0800 (Wed, 28 Dec 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/206635">r206635</a> - Change the MemoryCache and CachedResource adjustSize functions to take a long argument
https://bugs.webkit.org/show_bug.cgi?id=162708
<rdar://problem/28555702>
Reviewed by Brent Fulgham.
Source/WebCore:
Because the MemoryCache stores the size of the cached memory in unsigned,
two problems my happen when reporting a change in the size of the memory:
1. Signed integer overflow -- which can happen because MemoryCache::adjustSize()
takes a signed integer argument. If the allocated or the freed memory size is
larger than the maximum of a signed integer, an overflow will happen.
For the image caching code, this can be seen where the unsigned decodedSize
is casted to an integer before passing it to ImageObserver::decodedSizeChanged().
2. Unsigned integer overflow -- which can happen if the new allocated memory
size plus the currentSize exceeds the maximum of unsigned.
This can be seen in MemoryCache::adjustSize() where we add delta to m_liveSize
or m_deadSize without checking whether this addition will overflow or not. We
do not assert for overflow although we assert for underflow.
The fix for these two problems can be the following:
1. Make all the adjustSize functions all the way till MemoryCache::adjustSize()
take a signed long integer argument.
2. Do not create a NativeImagePtr for an ImageFrame if its frameBytes plus the
ImageFrameCache::decodedSize() will exceed the maximum of an unsigned integer.
* loader/cache/CachedImage.cpp:
(WebCore::CachedImage::decodedSizeChanged): Change the argument to be long. No overflow will happen when casting the argument from unsigned to long.
* loader/cache/CachedImage.h:
* loader/cache/CachedResource.cpp:
(WebCore::CachedResource::setDecodedSize): Use long integer casting when calling MemoryCache::adjustSize().
(WebCore::CachedResource::setEncodedSize): Ditto.
* loader/cache/MemoryCache.cpp:
(WebCore::MemoryCache::MemoryCache): Add as static assert to ensure sizeof(long long) can hold any unsigned or its negation.
(WebCore::MemoryCache::revalidationSucceeded): Use long integer casting when calling MemoryCache::adjustSize().
(WebCore::MemoryCache::remove): Ditto.
(WebCore::MemoryCache::adjustSize): Change the function argument to long integer. No overflow will happen when casting the argument from unsigned to long.
* loader/cache/MemoryCache.h:
* platform/graphics/ImageFrameCache.cpp:
(WebCore::ImageFrameCache::destroyIncompleteDecodedData): Call a function with its new name.
(WebCore::ImageFrameCache::decodedSizeChanged): Change the function argument to long integer. No overflow will happen when casting the argument from unsigned to long.
(WebCore::ImageFrameCache::decodedSizeIncreased): Use long integer casting when calling decodedSizeChanged().
(WebCore::ImageFrameCache::decodedSizeDecreased): Ditto.
(WebCore::ImageFrameCache::decodedSizeReset): Ditto.
(WebCore::ImageFrameCache::didDecodeProperties): Ditto.
(WebCore::ImageFrameCache::frameAtIndex): Do not create the NativeImage if adding its frameByes to the MemoryCache will cause numerical overflow.
(WebCore::ImageFrameCache::decodedSizeIncremented): Deleted. This function is renamed decodedSizeIncreased().
(WebCore::ImageFrameCache::decodedSizeDecremented): Deleted. This function is renamed decodedSizeDecreased().
* platform/graphics/ImageFrameCache.h:
* platform/graphics/ImageObserver.h:
* platform/graphics/IntSize.h:
(WebCore::IntSize::unclampedArea): Returns the area of an IntSize in size_t.
* platform/graphics/cg/PDFDocumentImage.cpp:
(WebCore::PDFDocumentImage::decodedSizeChanged): Use long integer casting when calling ImageObserver::decodedSizeChanged().
LayoutTests:
* TestExpectations: Remove failed tests.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit214LayoutTestsChangeLog">releases/WebKitGTK/webkit-2.14/LayoutTests/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCoreChangeLog">releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCoreloadercacheCachedImagecpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/loader/cache/CachedImage.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCoreloadercacheCachedImageh">releases/WebKitGTK/webkit-2.14/Source/WebCore/loader/cache/CachedImage.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCoreloadercacheCachedResourcecpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/loader/cache/CachedResource.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCoreloadercacheMemoryCachecpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/loader/cache/MemoryCache.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCoreloadercacheMemoryCacheh">releases/WebKitGTK/webkit-2.14/Source/WebCore/loader/cache/MemoryCache.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCoreplatformgraphicsBitmapImagecpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/platform/graphics/BitmapImage.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCoreplatformgraphicsImageObserverh">releases/WebKitGTK/webkit-2.14/Source/WebCore/platform/graphics/ImageObserver.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCoreplatformgraphicsIntSizeh">releases/WebKitGTK/webkit-2.14/Source/WebCore/platform/graphics/IntSize.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCoreplatformgraphicscgPDFDocumentImagecpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/platform/graphics/cg/PDFDocumentImage.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="releasesWebKitGTKwebkit214LayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/LayoutTests/ChangeLog (210197 => 210198)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/LayoutTests/ChangeLog 2016-12-28 11:06:44 UTC (rev 210197)
+++ releases/WebKitGTK/webkit-2.14/LayoutTests/ChangeLog 2016-12-28 12:15:48 UTC (rev 210198)
</span><span class="lines">@@ -1,3 +1,13 @@
</span><ins>+2016-09-30 Said Abou-Hallawa <sabouhallawa@apple.com>
+
+ Change the MemoryCache and CachedResource adjustSize functions to take a long argument
+ https://bugs.webkit.org/show_bug.cgi?id=162708
+ <rdar://problem/28555702>
+
+ Reviewed by Brent Fulgham.
+
+ * TestExpectations: Remove failed tests.
+
</ins><span class="cx"> 2016-10-25 Brent Fulgham <bfulgham@apple.com>
</span><span class="cx">
</span><span class="cx"> Prevent hit tests from being performed on an invalid render tree
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog (210197 => 210198)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog 2016-12-28 11:06:44 UTC (rev 210197)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog 2016-12-28 12:15:48 UTC (rev 210198)
</span><span class="lines">@@ -1,3 +1,63 @@
</span><ins>+2016-09-30 Said Abou-Hallawa <sabouhallawa@apple.com>
+
+ Change the MemoryCache and CachedResource adjustSize functions to take a long argument
+ https://bugs.webkit.org/show_bug.cgi?id=162708
+ <rdar://problem/28555702>
+
+ Reviewed by Brent Fulgham.
+
+ Because the MemoryCache stores the size of the cached memory in unsigned,
+ two problems my happen when reporting a change in the size of the memory:
+
+ 1. Signed integer overflow -- which can happen because MemoryCache::adjustSize()
+ takes a signed integer argument. If the allocated or the freed memory size is
+ larger than the maximum of a signed integer, an overflow will happen.
+ For the image caching code, this can be seen where the unsigned decodedSize
+ is casted to an integer before passing it to ImageObserver::decodedSizeChanged().
+
+ 2. Unsigned integer overflow -- which can happen if the new allocated memory
+ size plus the currentSize exceeds the maximum of unsigned.
+ This can be seen in MemoryCache::adjustSize() where we add delta to m_liveSize
+ or m_deadSize without checking whether this addition will overflow or not. We
+ do not assert for overflow although we assert for underflow.
+
+ The fix for these two problems can be the following:
+
+ 1. Make all the adjustSize functions all the way till MemoryCache::adjustSize()
+ take a signed long integer argument.
+
+ 2. Do not create a NativeImagePtr for an ImageFrame if its frameBytes plus the
+ ImageFrameCache::decodedSize() will exceed the maximum of an unsigned integer.
+
+ * loader/cache/CachedImage.cpp:
+ (WebCore::CachedImage::decodedSizeChanged): Change the argument to be long. No overflow will happen when casting the argument from unsigned to long.
+ * loader/cache/CachedImage.h:
+ * loader/cache/CachedResource.cpp:
+ (WebCore::CachedResource::setDecodedSize): Use long integer casting when calling MemoryCache::adjustSize().
+ (WebCore::CachedResource::setEncodedSize): Ditto.
+ * loader/cache/MemoryCache.cpp:
+ (WebCore::MemoryCache::MemoryCache): Add as static assert to ensure sizeof(long long) can hold any unsigned or its negation.
+ (WebCore::MemoryCache::revalidationSucceeded): Use long integer casting when calling MemoryCache::adjustSize().
+ (WebCore::MemoryCache::remove): Ditto.
+ (WebCore::MemoryCache::adjustSize): Change the function argument to long integer. No overflow will happen when casting the argument from unsigned to long.
+ * loader/cache/MemoryCache.h:
+ * platform/graphics/ImageFrameCache.cpp:
+ (WebCore::ImageFrameCache::destroyIncompleteDecodedData): Call a function with its new name.
+ (WebCore::ImageFrameCache::decodedSizeChanged): Change the function argument to long integer. No overflow will happen when casting the argument from unsigned to long.
+ (WebCore::ImageFrameCache::decodedSizeIncreased): Use long integer casting when calling decodedSizeChanged().
+ (WebCore::ImageFrameCache::decodedSizeDecreased): Ditto.
+ (WebCore::ImageFrameCache::decodedSizeReset): Ditto.
+ (WebCore::ImageFrameCache::didDecodeProperties): Ditto.
+ (WebCore::ImageFrameCache::frameAtIndex): Do not create the NativeImage if adding its frameByes to the MemoryCache will cause numerical overflow.
+ (WebCore::ImageFrameCache::decodedSizeIncremented): Deleted. This function is renamed decodedSizeIncreased().
+ (WebCore::ImageFrameCache::decodedSizeDecremented): Deleted. This function is renamed decodedSizeDecreased().
+ * platform/graphics/ImageFrameCache.h:
+ * platform/graphics/ImageObserver.h:
+ * platform/graphics/IntSize.h:
+ (WebCore::IntSize::unclampedArea): Returns the area of an IntSize in size_t.
+ * platform/graphics/cg/PDFDocumentImage.cpp:
+ (WebCore::PDFDocumentImage::decodedSizeChanged): Use long integer casting when calling ImageObserver::decodedSizeChanged().
+
</ins><span class="cx"> 2016-10-28 Brent Fulgham <bfulgham@apple.com>
</span><span class="cx">
</span><span class="cx"> Do a better job of protecting Frame objects in the context of JavaScript calls
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCoreloadercacheCachedImagecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/loader/cache/CachedImage.cpp (210197 => 210198)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/loader/cache/CachedImage.cpp 2016-12-28 11:06:44 UTC (rev 210197)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/loader/cache/CachedImage.cpp 2016-12-28 12:15:48 UTC (rev 210198)
</span><span class="lines">@@ -462,11 +462,12 @@
</span><span class="cx"> m_image->destroyDecodedData();
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void CachedImage::decodedSizeChanged(const Image* image, int delta)
</del><ins>+void CachedImage::decodedSizeChanged(const Image* image, long long delta)
</ins><span class="cx"> {
</span><span class="cx"> if (!image || image != m_image)
</span><span class="cx"> return;
</span><del>-
</del><ins>+
+ ASSERT(delta >= 0 || decodedSize() + delta >= 0);
</ins><span class="cx"> setDecodedSize(decodedSize() + delta);
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCoreloadercacheCachedImageh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/loader/cache/CachedImage.h (210197 => 210198)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/loader/cache/CachedImage.h 2016-12-28 11:06:44 UTC (rev 210197)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/loader/cache/CachedImage.h 2016-12-28 12:15:48 UTC (rev 210198)
</span><span class="lines">@@ -116,7 +116,7 @@
</span><span class="cx"> bool stillNeedsLoad() const override { return !errorOccurred() && status() == Unknown && !isLoading(); }
</span><span class="cx">
</span><span class="cx"> // ImageObserver
</span><del>- void decodedSizeChanged(const Image*, int delta) override;
</del><ins>+ void decodedSizeChanged(const Image*, long long delta) override;
</ins><span class="cx"> void didDraw(const Image*) override;
</span><span class="cx">
</span><span class="cx"> void animationAdvanced(const Image*) override;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCoreloadercacheCachedResourcecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/loader/cache/CachedResource.cpp (210197 => 210198)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/loader/cache/CachedResource.cpp 2016-12-28 11:06:44 UTC (rev 210197)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/loader/cache/CachedResource.cpp 2016-12-28 12:15:48 UTC (rev 210198)
</span><span class="lines">@@ -619,13 +619,13 @@
</span><span class="cx"> if (size == m_decodedSize)
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- int delta = size - m_decodedSize;
</del><ins>+ long long delta = static_cast<long long>(size) - m_decodedSize;
</ins><span class="cx">
</span><span class="cx"> // The object must be moved to a different queue, since its size has been changed.
</span><span class="cx"> // Remove before updating m_decodedSize, so we find the resource in the correct LRU list.
</span><span class="cx"> if (allowsCaching() && inCache())
</span><span class="cx"> MemoryCache::singleton().removeFromLRUList(*this);
</span><del>-
</del><ins>+
</ins><span class="cx"> m_decodedSize = size;
</span><span class="cx">
</span><span class="cx"> if (allowsCaching() && inCache()) {
</span><span class="lines">@@ -656,7 +656,7 @@
</span><span class="cx"> if (size == m_encodedSize)
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- int delta = size - m_encodedSize;
</del><ins>+ long long delta = static_cast<long long>(size) - m_encodedSize;
</ins><span class="cx">
</span><span class="cx"> // The object must be moved to a different queue, since its size has been changed.
</span><span class="cx"> // Remove before updating m_encodedSize, so we find the resource in the correct LRU list.
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCoreloadercacheMemoryCachecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/loader/cache/MemoryCache.cpp (210197 => 210198)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/loader/cache/MemoryCache.cpp 2016-12-28 11:06:44 UTC (rev 210197)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/loader/cache/MemoryCache.cpp 2016-12-28 12:15:48 UTC (rev 210198)
</span><span class="lines">@@ -71,6 +71,7 @@
</span><span class="cx"> , m_deadSize(0)
</span><span class="cx"> , m_pruneTimer(*this, &MemoryCache::prune)
</span><span class="cx"> {
</span><ins>+ static_assert(sizeof(long long) > sizeof(unsigned), "Numerical overflow can happen when adjusting the size of the cached memory.");
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> auto MemoryCache::sessionResourceMap(SessionID sessionID) const -> CachedResourceMap*
</span><span class="lines">@@ -148,7 +149,7 @@
</span><span class="cx"> resource.setInCache(true);
</span><span class="cx"> resource.updateResponseAfterRevalidation(response);
</span><span class="cx"> insertInLRUList(resource);
</span><del>- int delta = resource.size();
</del><ins>+ long long delta = resource.size();
</ins><span class="cx"> if (resource.decodedSize() && resource.hasClients())
</span><span class="cx"> insertInLiveDecodedResourcesList(resource);
</span><span class="cx"> if (delta)
</span><span class="lines">@@ -448,7 +449,7 @@
</span><span class="cx"> // Remove from the appropriate LRU list.
</span><span class="cx"> removeFromLRUList(resource);
</span><span class="cx"> removeFromLiveDecodedResourcesList(resource);
</span><del>- adjustSize(resource.hasClients(), -static_cast<int>(resource.size()));
</del><ins>+ adjustSize(resource.hasClients(), -static_cast<long long>(resource.size()));
</ins><span class="cx"> } else
</span><span class="cx"> ASSERT(resources->get(key) != &resource);
</span><span class="cx"> }
</span><span class="lines">@@ -641,13 +642,13 @@
</span><span class="cx"> m_deadSize += resource.size();
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void MemoryCache::adjustSize(bool live, int delta)
</del><ins>+void MemoryCache::adjustSize(bool live, long long delta)
</ins><span class="cx"> {
</span><span class="cx"> if (live) {
</span><del>- ASSERT(delta >= 0 || ((int)m_liveSize + delta >= 0));
</del><ins>+ ASSERT(delta >= 0 || (static_cast<long long>(m_liveSize) + delta >= 0));
</ins><span class="cx"> m_liveSize += delta;
</span><span class="cx"> } else {
</span><del>- ASSERT(delta >= 0 || ((int)m_deadSize + delta >= 0));
</del><ins>+ ASSERT(delta >= 0 || (static_cast<long long>(m_deadSize) + delta >= 0));
</ins><span class="cx"> m_deadSize += delta;
</span><span class="cx"> }
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCoreloadercacheMemoryCacheh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/loader/cache/MemoryCache.h (210197 => 210198)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/loader/cache/MemoryCache.h 2016-12-28 11:06:44 UTC (rev 210197)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/loader/cache/MemoryCache.h 2016-12-28 12:15:48 UTC (rev 210198)
</span><span class="lines">@@ -133,7 +133,7 @@
</span><span class="cx"> void removeFromLRUList(CachedResource&);
</span><span class="cx">
</span><span class="cx"> // Called to adjust the cache totals when a resource changes size.
</span><del>- void adjustSize(bool live, int delta);
</del><ins>+ void adjustSize(bool live, long long delta);
</ins><span class="cx">
</span><span class="cx"> // Track decoded resources that are in the cache and referenced by a Web page.
</span><span class="cx"> void insertInLiveDecodedResourcesList(CachedResource&);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCoreplatformgraphicsBitmapImagecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/platform/graphics/BitmapImage.cpp (210197 => 210198)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/platform/graphics/BitmapImage.cpp 2016-12-28 11:06:44 UTC (rev 210197)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/platform/graphics/BitmapImage.cpp 2016-12-28 12:15:48 UTC (rev 210198)
</span><span class="lines">@@ -44,6 +44,8 @@
</span><span class="cx"> #include <limits>
</span><span class="cx"> #endif
</span><span class="cx">
</span><ins>+#include <wtf/CheckedArithmetic.h>
+
</ins><span class="cx"> namespace WebCore {
</span><span class="cx">
</span><span class="cx"> BitmapImage::BitmapImage(ImageObserver* observer)
</span><span class="lines">@@ -174,7 +176,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> if (frameBytesCleared && imageObserver())
</span><del>- imageObserver()->decodedSizeChanged(this, -safeCast<int>(frameBytesCleared));
</del><ins>+ imageObserver()->decodedSizeChanged(this, -static_cast<long long>(frameBytesCleared));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void BitmapImage::cacheFrame(size_t index, SubsamplingLevel subsamplingLevel, ImageFrameCaching frameCaching)
</span><span class="lines">@@ -202,12 +204,11 @@
</span><span class="cx">
</span><span class="cx"> LOG(Images, "BitmapImage %p cacheFrame %lu (%s%u bytes, complete %d)", this, index, frameCaching == CacheMetadataOnly ? "metadata only, " : "", m_frames[index].m_frameBytes, m_frames[index].m_isComplete);
</span><span class="cx">
</span><del>- if (m_frames[index].m_image) {
- int deltaBytes = safeCast<int>(m_frames[index].m_frameBytes);
- m_decodedSize += deltaBytes;
</del><ins>+ if (m_frames[index].m_image && WTF::isInBounds<unsigned>(m_frames[index].m_frameBytes + m_decodedSize)) {
+ m_decodedSize += m_frames[index].m_frameBytes;
</ins><span class="cx"> // The fully-decoded frame will subsume the partially decoded data used
</span><span class="cx"> // to determine image properties.
</span><del>- deltaBytes -= m_decodedPropertiesSize;
</del><ins>+ long long deltaBytes = static_cast<long long>(m_frames[index].m_frameBytes) - m_decodedPropertiesSize;
</ins><span class="cx"> m_decodedPropertiesSize = 0;
</span><span class="cx"> if (imageObserver())
</span><span class="cx"> imageObserver()->decodedSizeChanged(this, deltaBytes);
</span><span class="lines">@@ -219,16 +220,11 @@
</span><span class="cx"> if (m_decodedSize)
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- size_t updatedSize = m_source.bytesDecodedToDetermineProperties();
</del><ins>+ unsigned updatedSize = m_source.bytesDecodedToDetermineProperties();
</ins><span class="cx"> if (m_decodedPropertiesSize == updatedSize)
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- int deltaBytes = updatedSize - m_decodedPropertiesSize;
-#if !ASSERT_DISABLED
- bool overflow = updatedSize > m_decodedPropertiesSize && deltaBytes < 0;
- bool underflow = updatedSize < m_decodedPropertiesSize && deltaBytes > 0;
- ASSERT(!overflow && !underflow);
-#endif
</del><ins>+ long long deltaBytes = static_cast<long long>(updatedSize) - m_decodedPropertiesSize;
</ins><span class="cx"> m_decodedPropertiesSize = updatedSize;
</span><span class="cx"> if (imageObserver())
</span><span class="cx"> imageObserver()->decodedSizeChanged(this, deltaBytes);
</span><span class="lines">@@ -394,12 +390,15 @@
</span><span class="cx"> LOG(Images, " subsamplingLevel was %d, resampling", m_frames[index].m_subsamplingLevel);
</span><span class="cx">
</span><span class="cx"> // If the image is already cached, but at too small a size, re-decode a larger version.
</span><del>- int sizeChange = -m_frames[index].m_frameBytes;
</del><ins>+ unsigned sizeChange = m_frames[index].m_frameBytes;
</ins><span class="cx"> m_frames[index].clear(true);
</span><span class="cx"> invalidatePlatformData();
</span><del>- m_decodedSize += sizeChange;
- if (imageObserver())
- imageObserver()->decodedSizeChanged(this, sizeChange);
</del><ins>+ if (sizeChange) {
+ ASSERT(m_decodedSize >= sizeChange);
+ m_decodedSize -= sizeChange;
+ if (imageObserver())
+ imageObserver()->decodedSizeChanged(this, -static_cast<long long>(sizeChange));
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // If we haven't fetched a frame yet, do so.
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCoreplatformgraphicsImageObserverh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/platform/graphics/ImageObserver.h (210197 => 210198)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/platform/graphics/ImageObserver.h 2016-12-28 11:06:44 UTC (rev 210197)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/platform/graphics/ImageObserver.h 2016-12-28 12:15:48 UTC (rev 210198)
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx"> protected:
</span><span class="cx"> virtual ~ImageObserver() {}
</span><span class="cx"> public:
</span><del>- virtual void decodedSizeChanged(const Image*, int delta) = 0;
</del><ins>+ virtual void decodedSizeChanged(const Image*, long long delta) = 0;
</ins><span class="cx"> virtual void didDraw(const Image*) = 0;
</span><span class="cx">
</span><span class="cx"> virtual void animationAdvanced(const Image*) = 0;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCoreplatformgraphicsIntSizeh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/platform/graphics/IntSize.h (210197 => 210198)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/platform/graphics/IntSize.h 2016-12-28 11:06:44 UTC (rev 210197)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/platform/graphics/IntSize.h 2016-12-28 12:15:48 UTC (rev 210198)
</span><span class="lines">@@ -131,6 +131,11 @@
</span><span class="cx"> return Checked<unsigned, T>(abs(m_width)) * abs(m_height);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ size_t unclampedArea() const
+ {
+ return static_cast<size_t>(abs(m_width)) * abs(m_height);
+ }
+
</ins><span class="cx"> int diagonalLengthSquared() const
</span><span class="cx"> {
</span><span class="cx"> return m_width * m_width + m_height * m_height;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCoreplatformgraphicscgPDFDocumentImagecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/platform/graphics/cg/PDFDocumentImage.cpp (210197 => 210198)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/platform/graphics/cg/PDFDocumentImage.cpp 2016-12-28 11:06:44 UTC (rev 210197)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/platform/graphics/cg/PDFDocumentImage.cpp 2016-12-28 12:15:48 UTC (rev 210198)
</span><span class="lines">@@ -182,7 +182,7 @@
</span><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> if (imageObserver())
</span><del>- imageObserver()->decodedSizeChanged(this, -safeCast<int>(m_cachedBytes) + newCachedBytes);
</del><ins>+ imageObserver()->decodedSizeChanged(this, -static_cast<long long>(m_cachedBytes) + newCachedBytes);
</ins><span class="cx">
</span><span class="cx"> ASSERT(s_allDecodedDataSize >= m_cachedBytes);
</span><span class="cx"> // Update with the difference in two steps to avoid unsigned underflow subtraction.
</span></span></pre>
</div>
</div>
</body>
</html>