diff options
| author | Peter Boström <pbos@chromium.org> | 2023-02-24 00:33:06 +0000 |
|---|---|---|
| committer | Michael Brüning <michael.bruning@qt.io> | 2023-04-04 11:26:41 +0000 |
| commit | 906ec4b3148e569a3d0bfb7fa5c4ac8647b07d17 (patch) | |
| tree | 49910e59e53547cb45d5e28098c6e8bda290de2b | |
| parent | 7acd92df98d7aeabb81389fef7fb82b6f50256a6 (diff) | |
| download | qtwebengine-chromium-906ec4b3148e569a3d0bfb7fa5c4ac8647b07d17.tar.gz | |
[Backport] Security bug 1418734
Partial manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/4288168:
Convert known it != end() DCHECK failures to CHECK
M102 merge issues:
third_party/blink/renderer/core/annotation/annotation_agent_impl.cc is
not present in 102
These have hit on DCHECK builds in the wild and precede erasing or
dereferencing an iterator that is UB.
This CL excludes DCHECK failures that precede non-DCHECK handling of the
it != end() failures. Those should probably be rewritten as CHECKs
but are less urgent and semi-orthogonal.
Known crashes (one per file) are:
crash/dc49e3cadab36d4c
crash/0ee3427d25937024
crash/b89303e84d123019
crash/cc35183b861a4992
Bug: 1418734
Change-Id: I81ed7b45be33769e250c65c8bb7334a34be4380e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4288168
Commit-Queue: Peter Boström <pbos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1109350}
(cherry picked from commit 1aec0b297900a7b59bd24314dff239f3c5697f45)
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468621
Reviewed-by: Michal Klocek <michal.klocek@qt.io>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/469849
| -rw-r--r-- | chromium/cc/tiles/gpu_image_decode_cache.cc | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/chromium/cc/tiles/gpu_image_decode_cache.cc b/chromium/cc/tiles/gpu_image_decode_cache.cc index 75d0bb0c86a..04ea83859f0 100644 --- a/chromium/cc/tiles/gpu_image_decode_cache.cc +++ b/chromium/cc/tiles/gpu_image_decode_cache.cc @@ -1337,8 +1337,8 @@ Iterator GpuImageDecodeCache::RemoveFromPersistentCache(Iterator it) { } auto entries_it = paint_image_entries_.find(it->second->paint_image_id); - DCHECK(entries_it != paint_image_entries_.end()); - DCHECK_GT(entries_it->second.count, 0u); + CHECK(entries_it != paint_image_entries_.end()); + CHECK_GT(entries_it->second.count, 0u); // If this is the last entry for this image, remove its tracking. --entries_it->second.count; |