[webkit-changes] [202922] trunk/Source/WebKit2

Thu, 07 Jul 2016 11:48:07 -0700

Title: [202922] trunk/Source/WebKit2
Revision
202922
Author
[email protected]
Date
2016-07-07 11:47:51 -0700 (Thu, 07 Jul 2016)

Log Message

Memory corruption destroying PaymentCoordinator
https://bugs.webkit.org/show_bug.cgi?id=159516
rdar://problem/27222857

Reviewed by Tim Horton.

Introduce a new MessageReceiverMap::removeMessageReceiver that takes a MessageReceiver
and removes all traces of it in the message receiver map. Use it in the WebPaymentCoordinator destructor.

* Platform/IPC/MessageReceiverMap.cpp:
(IPC::MessageReceiverMap::removeMessageReceiver):
* Platform/IPC/MessageReceiverMap.h:
* Shared/ChildProcess.cpp:
(WebKit::ChildProcess::removeMessageReceiver):
* Shared/ChildProcess.h:
* WebProcess/ApplePay/WebPaymentCoordinator.cpp:
(WebKit::WebPaymentCoordinator::~WebPaymentCoordinator):

Modified Paths

Diff

Modified: trunk/Source/WebKit2/ChangeLog (202921 => 202922)


--- trunk/Source/WebKit2/ChangeLog	2016-07-07 18:30:37 UTC (rev 202921)
+++ trunk/Source/WebKit2/ChangeLog	2016-07-07 18:47:51 UTC (rev 202922)
@@ -1,3 +1,23 @@
+2016-07-07  Anders Carlsson  <[email protected]>
+
+        Memory corruption destroying PaymentCoordinator
+        https://bugs.webkit.org/show_bug.cgi?id=159516
+        rdar://problem/27222857
+
+        Reviewed by Tim Horton.
+
+        Introduce a new MessageReceiverMap::removeMessageReceiver that takes a MessageReceiver
+        and removes all traces of it in the message receiver map. Use it in the WebPaymentCoordinator destructor.
+
+        * Platform/IPC/MessageReceiverMap.cpp:
+        (IPC::MessageReceiverMap::removeMessageReceiver):
+        * Platform/IPC/MessageReceiverMap.h:
+        * Shared/ChildProcess.cpp:
+        (WebKit::ChildProcess::removeMessageReceiver):
+        * Shared/ChildProcess.h:
+        * WebProcess/ApplePay/WebPaymentCoordinator.cpp:
+        (WebKit::WebPaymentCoordinator::~WebPaymentCoordinator):
+
 2016-07-07  Csaba Osztrogonác  <[email protected]>
 
         [Mac][cmake] Unreviewed buildfix after r202889. Just for fun.

Modified: trunk/Source/WebKit2/Platform/IPC/MessageReceiverMap.cpp (202921 => 202922)


--- trunk/Source/WebKit2/Platform/IPC/MessageReceiverMap.cpp	2016-07-07 18:30:37 UTC (rev 202921)
+++ trunk/Source/WebKit2/Platform/IPC/MessageReceiverMap.cpp	2016-07-07 18:47:51 UTC (rev 202922)
@@ -77,6 +77,27 @@
     m_messageReceivers.remove(it);
 }
 
+void MessageReceiverMap::removeMessageReceiver(MessageReceiver& messageReceiver)
+{
+    Vector<StringReference> globalReceiversToRemove;
+    for (auto& nameAndReceiver : m_globalMessageReceivers) {
+        if (nameAndReceiver.value == &messageReceiver)
+            globalReceiversToRemove.append(nameAndReceiver.key);
+    }
+
+    for (auto& globalReceiverToRemove : globalReceiversToRemove)
+        removeMessageReceiver(globalReceiverToRemove);
+
+    Vector<std::pair<StringReference, uint64_t>> receiversToRemove;
+    for (auto& nameAndIdAndReceiver : m_messageReceivers) {
+        if (nameAndIdAndReceiver.value == &messageReceiver)
+            receiversToRemove.append(std::make_pair(nameAndIdAndReceiver.key.first, nameAndIdAndReceiver.key.second));
+    }
+
+    for (auto& receiverToRemove : receiversToRemove)
+        removeMessageReceiver(receiverToRemove.first, receiverToRemove.second);
+}
+
 void MessageReceiverMap::invalidate()
 {
     for (auto& messageReceiver : m_globalMessageReceivers.values())

Modified: trunk/Source/WebKit2/Platform/IPC/MessageReceiverMap.h (202921 => 202922)


--- trunk/Source/WebKit2/Platform/IPC/MessageReceiverMap.h	2016-07-07 18:30:37 UTC (rev 202921)
+++ trunk/Source/WebKit2/Platform/IPC/MessageReceiverMap.h	2016-07-07 18:47:51 UTC (rev 202922)
@@ -47,6 +47,7 @@
 
     void removeMessageReceiver(StringReference messageReceiverName);
     void removeMessageReceiver(StringReference messageReceiverName, uint64_t destinationID);
+    void removeMessageReceiver(MessageReceiver&);
 
     void invalidate();

Modified: trunk/Source/WebKit2/Shared/ChildProcess.cpp (202921 => 202922)


--- trunk/Source/WebKit2/Shared/ChildProcess.cpp	2016-07-07 18:30:37 UTC (rev 202921)
+++ trunk/Source/WebKit2/Shared/ChildProcess.cpp	2016-07-07 18:47:51 UTC (rev 202922)
@@ -120,6 +120,11 @@
     m_messageReceiverMap.removeMessageReceiver(messageReceiverName);
 }
 
+void ChildProcess::removeMessageReceiver(IPC::MessageReceiver& messageReceiver)
+{
+    m_messageReceiverMap.removeMessageReceiver(messageReceiver);
+}
+
 void ChildProcess::disableTermination()
 {
     m_terminationCounter++;

Modified: trunk/Source/WebKit2/Shared/ChildProcess.h (202921 => 202922)


--- trunk/Source/WebKit2/Shared/ChildProcess.h	2016-07-07 18:30:37 UTC (rev 202921)
+++ trunk/Source/WebKit2/Shared/ChildProcess.h	2016-07-07 18:47:51 UTC (rev 202922)
@@ -65,6 +65,7 @@
     void addMessageReceiver(IPC::StringReference messageReceiverName, uint64_t destinationID, IPC::MessageReceiver&);
     void removeMessageReceiver(IPC::StringReference messageReceiverName, uint64_t destinationID);
     void removeMessageReceiver(IPC::StringReference messageReceiverName);
+    void removeMessageReceiver(IPC::MessageReceiver&);
 
     void setProcessSuppressionEnabled(bool);

Modified: trunk/Source/WebKit2/WebProcess/ApplePay/WebPaymentCoordinator.cpp (202921 => 202922)


--- trunk/Source/WebKit2/WebProcess/ApplePay/WebPaymentCoordinator.cpp	2016-07-07 18:30:37 UTC (rev 202921)
+++ trunk/Source/WebKit2/WebProcess/ApplePay/WebPaymentCoordinator.cpp	2016-07-07 18:47:51 UTC (rev 202922)
@@ -47,7 +47,7 @@
 
 WebPaymentCoordinator::~WebPaymentCoordinator()
 {
-    WebProcess::singleton().removeMessageReceiver(Messages::WebPaymentCoordinator::messageReceiverName(), m_webPage.pageID());
+    WebProcess::singleton().removeMessageReceiver(*this);
 }
 
 bool WebPaymentCoordinator::supportsVersion(unsigned version)

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to