Title: [201303] trunk/Source/WebCore
- Revision
- 201303
- Author
- cdu...@apple.com
- Date
- 2016-05-23 16:19:23 -0700 (Mon, 23 May 2016)
Log Message
Fix undefined behavior introduced in r201290.
https://bugs.webkit.org/show_bug.cgi?id=157961
Reviewed by Alex Christensen.
The evaluation order of function arguments is undefined so it is unsafe to
copyRef() and WTFMove() the same parameter in a function call.
* css/CSSBasicShapes.h:
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (201302 => 201303)
--- trunk/Source/WebCore/ChangeLog 2016-05-23 23:14:33 UTC (rev 201302)
+++ trunk/Source/WebCore/ChangeLog 2016-05-23 23:19:23 UTC (rev 201303)
@@ -1,3 +1,15 @@
+2016-05-23 Chris Dumez <cdu...@apple.com>
+
+ Fix undefined behavior introduced in r201290.
+ https://bugs.webkit.org/show_bug.cgi?id=157961
+
+ Reviewed by Alex Christensen.
+
+ The evaluation order of function arguments is undefined so it is unsafe to
+ copyRef() and WTFMove() the same parameter in a function call.
+
+ * css/CSSBasicShapes.h:
+
2016-05-23 Brady Eidson <beid...@apple.com>
Speculative fix for:
Modified: trunk/Source/WebCore/css/CSSBasicShapes.h (201302 => 201303)
--- trunk/Source/WebCore/css/CSSBasicShapes.h 2016-05-23 23:14:33 UTC (rev 201302)
+++ trunk/Source/WebCore/css/CSSBasicShapes.h 2016-05-23 23:19:23 UTC (rev 201303)
@@ -91,17 +91,17 @@
void updateShapeSize1Value(Ref<CSSPrimitiveValue>&& value1)
{
- updateShapeSize4Values(value1.copyRef(), value1.copyRef(), value1.copyRef(), WTFMove(value1));
+ updateShapeSize4Values(value1.copyRef(), value1.copyRef(), value1.copyRef(), value1.copyRef());
}
void updateShapeSize2Values(Ref<CSSPrimitiveValue>&& value1, Ref<CSSPrimitiveValue>&& value2)
{
- updateShapeSize4Values(value1.copyRef(), value2.copyRef(), WTFMove(value1), WTFMove(value2));
+ updateShapeSize4Values(value1.copyRef(), value2.copyRef(), value1.copyRef(), value2.copyRef());
}
void updateShapeSize3Values(Ref<CSSPrimitiveValue>&& value1, Ref<CSSPrimitiveValue>&& value2, Ref<CSSPrimitiveValue>&& value3)
{
- updateShapeSize4Values(WTFMove(value1), value2.copyRef(), WTFMove(value3), WTFMove(value2));
+ updateShapeSize4Values(WTFMove(value1), value2.copyRef(), WTFMove(value3), value2.copyRef());
}
void setTopLeftRadius(RefPtr<CSSPrimitiveValue>&& radius) { m_topLeftRadius = WTFMove(radius); }
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
