tree a66f30608406714f4234cfb2d88f7984fa0b4b70
parent 1af45fc1915c308be35b19553899267f3a4f02ea
author commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1643297783 +0000
committer commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1643297783 +0000

jsc_fuz/wktr: crash with new XRReferenceSpaceEvent('', {referenceSpace})
https://bugs.webkit.org/show_bug.cgi?id=235456

Patch by Gabriel Nava Marino <gnavamarino@apple.com> on 2022-01-27
Reviewed by Chris Dumez.

Source/WebCore:

FastMalloc.h specifies that each derived class needs to be annotated as well with WTF_MAKE_ISO_ALLOCATED
if the base class is annotated with WTF_MAKE_ISO_ALLOCATED.

After doing this, the crash in WebCore::Event::operator new(unsigned long) is no longer reproducible.
However, this caused ASSERT(m_transform) to be hit in debug builds with the attached test case.

The XRReferenceSpaceEvent spec specifies the transform attribute as nullable
(https://immersive-web.github.io/webxr/#dictdef-xrreferencespaceeventinit), so this patch updates the
XRReferenceSpaceEvent IDL and implementation to match the spec, and removes the ASSERT accordingly.

Test: webxr/xr-reference-space-event-crash.html

* Modules/webxr/XRReferenceSpaceEvent.cpp:
(WebCore::XRReferenceSpaceEvent::XRReferenceSpaceEvent):
(WebCore::XRReferenceSpaceEvent::transform const):
* Modules/webxr/XRReferenceSpaceEvent.h:
* Modules/webxr/XRReferenceSpaceEvent.idl:

LayoutTests:

* webxr/xr-reference-space-event-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@288672 268f45cc-cd09-0410-ab3c-d52691b4dbfc