[webkit-reviews] review granted: [Bug 120802] [CSS Shapes] Heap-buffer-overflow in WebCore::ShapeInterval<float>::subtractShapeIntervals : [Attachment 210673] Patch

[bugzilla-daemon at webkit.org]

Darin Adler <darin at apple.com> has granted Hans Muller
<giles_joplin at yahoo.com>'s request for review:
Bug 120802: [CSS Shapes] Heap-buffer-overflow in
WebCore::ShapeInterval<float>::subtractShapeIntervals
https://bugs.webkit.org/show_bug.cgi?id=120802

Attachment 210673: Patch
https://bugs.webkit.org/attachment.cgi?id=210673&action=review

------- Additional Comments from Darin Adler <darin at apple.com>
The coding style here is awkward. The names “a/b increment” are not so good. I
would call them shouldIncrementA/B instead. Also, the logic seems unnecessarily
twisted. I have to read it over and over again to be sure it’s right. Might be
worth another look to see if we can make the logic clearer. I think we could
probably make a version that uses expressions like *aNext++ and eliminates the
local variables that would be a lot less confusing.