Revert "Fix unsafe buffer usage in base/synchronization/waitable_event.cc"
This reverts commit bc74b50790a1d73cde36c20665bf55aefbe9d73e.
Reason for revert: Potential culprit for crbug.com/447717293
Original change's description:
> Fix unsafe buffer usage in base/synchronization/waitable_event.cc
>
> Fixed unsafe buffer usage in base/synchronization/waitable_event.cc by replacing a C-style array with base::span in WaitableEvent::WaitMany and updating its call sites.
>
> Generated with gemini-cli and additional manual fixes.
>
> Bug: 435317390
> Bug: 438966593
> Change-Id: I5489408919227b35e4ee29d344e6253a3e53c2c7
> Fixed: 438966593
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6909891
> Owners-Override: Daniel Cheng <dcheng@chromium.org>
> Commit-Queue: Florian Jacky <fjacky@chromium.org>
> Reviewed-by: Daniel Cheng <dcheng@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#1510739}
Bug: 435317390
Bug: 438966593
Bug: 447717293
Change-Id: Idf9ee4ee458f8cfd024c696d07839f0416ee4dff
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6994680
Reviewed-by: Colin Blundell <blundell@chromium.org>
Commit-Queue: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Auto-Submit: Florian Jacky <fjacky@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1522253}
NOKEYCHECK=True
GitOrigin-RevId: 00a82fc1e082886a495a800cb5579f9eca52a161
diff --git a/core/ports/ports_unittest.cc b/core/ports/ports_unittest.cc
index 0e3a2f6..95b0135 100644
--- a/core/ports/ports_unittest.cc
+++ b/core/ports/ports_unittest.cc
@@ -377,7 +377,7 @@
std::vector<base::WaitableEvent*> events;
for (const auto& entry : nodes_)
events.push_back(&entry.second->idle_event());
- base::WaitableEvent::WaitMany(events);
+ base::WaitableEvent::WaitMany(events.data(), events.size());
}
}
diff --git a/public/cpp/system/wait.cc b/public/cpp/system/wait.cc
index a0b9fae..1b440e6 100644
--- a/public/cpp/system/wait.cc
+++ b/public/cpp/system/wait.cc
@@ -175,7 +175,7 @@
DCHECK_EQ(MOJO_RESULT_OK, rv);
// Wait for one of the contexts to signal. First one wins.
- index = base::WaitableEvent::WaitMany(events);
+ index = base::WaitableEvent::WaitMany(events.data(), events.size());
ready_result = contexts[index]->wait_result();
ready_state = contexts[index]->wait_state();
}
diff --git a/public/cpp/system/wait_set.cc b/public/cpp/system/wait_set.cc
index 6d8efd8..2ca6c1a 100644
--- a/public/cpp/system/wait_set.cc
+++ b/public/cpp/system/wait_set.cc
@@ -205,7 +205,7 @@
events[dest_index] = e;
}
- size_t index = base::WaitableEvent::WaitMany(events);
+ size_t index = base::WaitableEvent::WaitMany(events.data(), events.size());
base::AutoLock lock(lock_);
// Pop as many handles as we can out of the ready set and return them. Note
