Commit 2c03896d authored by Dave Tapuska's avatar Dave Tapuska Committed by Commit Bot

Fix 64 bit truncation on display_item.h

Assign the derived size after the SECURITY_DCHECKS to make it clear
we never expect this to exceed the size reserved.

BUG=879657

Change-Id: I1bb9f8724b9605499286935002a45508e58f2b04
Reviewed-on: https://chromium-review.googlesource.com/c/1347577Reviewed-by: default avatarRobert Flack <flackr@chromium.org>
Commit-Queue: Dave Tapuska <dtapuska@chromium.org>
Cr-Commit-Position: refs/heads/master@{#611381}
parent 0a00b236
...@@ -152,7 +152,6 @@ class PLATFORM_EXPORT DisplayItem { ...@@ -152,7 +152,6 @@ class PLATFORM_EXPORT DisplayItem {
visual_rect_(client.VisualRect()), visual_rect_(client.VisualRect()),
outset_for_raster_effects_(client.VisualRectOutsetForRasterEffects()), outset_for_raster_effects_(client.VisualRectOutsetForRasterEffects()),
type_(type), type_(type),
derived_size_(derived_size),
fragment_(0), fragment_(0),
is_cacheable_(client.IsCacheable()), is_cacheable_(client.IsCacheable()),
is_tombstone_(false) { is_tombstone_(false) {
...@@ -160,6 +159,7 @@ class PLATFORM_EXPORT DisplayItem { ...@@ -160,6 +159,7 @@ class PLATFORM_EXPORT DisplayItem {
// If it doesn't, enlarge |derived_size_| and fix this assert. // If it doesn't, enlarge |derived_size_| and fix this assert.
SECURITY_DCHECK(derived_size < (1 << 8)); SECURITY_DCHECK(derived_size < (1 << 8));
SECURITY_DCHECK(derived_size >= sizeof(*this)); SECURITY_DCHECK(derived_size >= sizeof(*this));
derived_size_ = static_cast<unsigned>(derived_size);
} }
virtual ~DisplayItem() = default; virtual ~DisplayItem() = default;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment