Attachment 360331 Details for Bug 193901 – patch

[patch] patch

removeUserScriptMessageHandlerInternal-crash-2.patch (text/plain), 1.71 KB, created by Antti Koivisto on 2019-01-28 04:30:29 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Antti Koivisto

Created: 2019-01-28 04:30:29 PST

Size: 1.71 KB

patch

obsolete

>Index: Source/WebKit/ChangeLog
>===================================================================
>--- Source/WebKit/ChangeLog	(revision 240577)
>+++ Source/WebKit/ChangeLog	(working copy)
>@@ -1,3 +1,20 @@
>+2019-01-28  Antti Koivisto  <antti@apple.com>
>+
>+        WebUserContentController::removeUserScriptMessageHandlerInternal may deref and delete itself
>+        https://bugs.webkit.org/show_bug.cgi?id=193901
>+        <rdar://problem/47338669>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Don't know how to repro.
>+
>+        * WebProcess/UserContent/WebUserContentController.cpp:
>+        (WebKit::WebUserContentController::removeUserScriptMessageHandlerInternal):
>+
>+        Calling userMessageHandlers.removeFirstMatching() may remove the last ref to this
>+        (because WebUserMessageHandlerDescriptorProxy refs WebUserContentController).
>+        Fix by protecting this over the function.
>+
> 2018-12-15  Darin Adler  <darin@apple.com>
> 
>         Replace many uses of String::format with more type-safe alternatives
>Index: Source/WebKit/WebProcess/UserContent/WebUserContentController.cpp
>===================================================================
>--- Source/WebKit/WebProcess/UserContent/WebUserContentController.cpp	(revision 240407)
>+++ Source/WebKit/WebProcess/UserContent/WebUserContentController.cpp	(working copy)
>@@ -330,6 +330,8 @@ void WebUserContentController::removeUse
>     if (it == m_userMessageHandlers.end())
>         return;
> 
>+    auto protectedThis = makeRef(*this);
>+
>     auto& userMessageHandlers = it->value;
>     bool userMessageHandlersChanged = userMessageHandlers.removeFirstMatching([userScriptMessageHandlerIdentifier](auto& pair) {
>         return pair.first ==  userScriptMessageHandlerIdentifier;

Actions: View | Formatted Diff | Diff

Attachments on bug 193901: 360330 | 360331