Attachment 371879 Details for Bug 198766 – Patch

[patch] Patch

bug-198766-20190611142543.patch (text/plain), 3.11 KB, created by Sihui Liu on 2019-06-11 14:25:44 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Sihui Liu

Created: 2019-06-11 14:25:44 PDT

Size: 3.11 KB

patch

obsolete

>Subversion Revision: 246319
>diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
>index 132a1e670f07e43122fd47b6c8f5feda406be8c2..fca5c5910ba0becf5c0468b4412eb91f84e9f70e 100644
>--- a/Source/WebKit/ChangeLog
>+++ b/Source/WebKit/ChangeLog
>@@ -1,3 +1,18 @@
>+2019-06-11  Sihui Liu  <sihui_liu@apple.com>
>+
>+        Add assertions to help debug crash at WebKit::HistoryEntryDataEncoder::operator<<
>+        https://bugs.webkit.org/show_bug.cgi?id=198766
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * Shared/SessionState.h:
>+        (WebKit::FrameState::~FrameState):
>+        * UIProcess/API/C/WKPage.cpp:
>+        (WKPageCopySessionState):
>+        * UIProcess/mac/LegacySessionStateCoding.cpp:
>+        (WebKit::HistoryEntryDataEncoder::encodeFixedLengthData):
>+        (WebKit::encodeFrameStateNode):
>+
> 2019-06-11  Antti Koivisto  <antti@apple.com>
> 
>         REGRESSION (iOS): Can't scroll litter-robot.com checkout form's dropdown menus
>diff --git a/Source/WebKit/Shared/SessionState.h b/Source/WebKit/Shared/SessionState.h
>index 69b9955de77ec98b64d4a752d17862df2ba60384..93336880da683696aa90a3b2484b55d958c5afc7 100644
>--- a/Source/WebKit/Shared/SessionState.h
>+++ b/Source/WebKit/Shared/SessionState.h
>@@ -111,6 +111,9 @@ struct FrameState {
> #endif
> 
>     Vector<FrameState> children;
>+
>+    bool isDestructed { false };
>+    ~FrameState() { isDestructed = true; }
> };
> 
> struct PageState {
>diff --git a/Source/WebKit/UIProcess/API/C/WKPage.cpp b/Source/WebKit/UIProcess/API/C/WKPage.cpp
>index ed86358201b4cef5b3f6b1a2f70fcb93efb764f2..ccc330f3024761fe739744562230526678b79040 100644
>--- a/Source/WebKit/UIProcess/API/C/WKPage.cpp
>+++ b/Source/WebKit/UIProcess/API/C/WKPage.cpp
>@@ -480,8 +480,9 @@ WKTypeRef WKPageCopySessionState(WKPageRef pageRef, void* context, WKPageSession
>         return true;
>     });
> 
>+    auto data = encodeLegacySessionState(sessionState);
>     if (shouldReturnData)
>-        return toAPI(encodeLegacySessionState(sessionState).leakRef());
>+        return toAPI(data.leakRef());
> 
>     return toAPI(&API::SessionState::create(WTFMove(sessionState)).leakRef());
> }
>diff --git a/Source/WebKit/UIProcess/mac/LegacySessionStateCoding.cpp b/Source/WebKit/UIProcess/mac/LegacySessionStateCoding.cpp
>index ea6c3777e50136cca586c3740c7ca4b2966e9943..8ad6d7cf85b35209b6c3219f6d3d768af5b68c07 100644
>--- a/Source/WebKit/UIProcess/mac/LegacySessionStateCoding.cpp
>+++ b/Source/WebKit/UIProcess/mac/LegacySessionStateCoding.cpp
>@@ -208,6 +208,7 @@ private:
> 
>     void encodeFixedLengthData(const uint8_t* data, size_t size, unsigned alignment)
>     {
>+        RELEASE_ASSERT(data);
>         ASSERT(!(reinterpret_cast<uintptr_t>(data) % alignment));
> 
>         uint8_t* buffer = grow(alignment, size);
>@@ -318,7 +319,9 @@ static void encodeFrameStateNode(HistoryEntryDataEncoder& encoder, const FrameSt
> {
>     encoder << static_cast<uint64_t>(frameState.children.size());
> 
>+    RELEASE_ASSERT(!frameState.isDestructed);
>     for (const auto& childFrameState : frameState.children) {
>+        RELEASE_ASSERT(!childFrameState.isDestructed);
>         encoder << childFrameState.originalURLString;
>         encoder << childFrameState.urlString;
>

Actions: View | Formatted Diff | Diff

Attachments on bug 198766: 371874 | 371879 | 371968 | 371990