Title: [259753] trunk
- Revision
- 259753
- Author
- [email protected]
- Date
- 2020-04-08 13:15:58 -0700 (Wed, 08 Apr 2020)
Log Message
[macOS] Crash under WebKit::SandboxExtension::consume
https://bugs.webkit.org/show_bug.cgi?id=210188
Reviewed by Geoffrey Garen.
Source/WebKit:
When issuing a mach lookup extension to the database mapping service in the UI process fails, the WebContent
process will crash when trying to consume the extension.
No new tests, since I am not able to reproduce the issue.
* UIProcess/Cocoa/WebProcessPoolCocoa.mm:
(WebKit::WebProcessPool::platformInitializeWebProcess):
* WebProcess/com.apple.WebProcess.sb.in:
LayoutTests:
* fast/sandbox/mac/sandbox-mach-lookup-expected.txt:
* fast/sandbox/mac/sandbox-mach-lookup.html:
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (259752 => 259753)
--- trunk/LayoutTests/ChangeLog 2020-04-08 20:14:50 UTC (rev 259752)
+++ trunk/LayoutTests/ChangeLog 2020-04-08 20:15:58 UTC (rev 259753)
@@ -1,3 +1,13 @@
+2020-04-08 Per Arne Vollan <[email protected]>
+
+ [macOS] Crash under WebKit::SandboxExtension::consume
+ https://bugs.webkit.org/show_bug.cgi?id=210188
+
+ Reviewed by Geoffrey Garen.
+
+ * fast/sandbox/mac/sandbox-mach-lookup-expected.txt:
+ * fast/sandbox/mac/sandbox-mach-lookup.html:
+
2020-04-08 Jacob Uphoff <[email protected]>
[macOS debug] Layout Test imported/w3c/web-platform-tests/media-source/SourceBuffer-abort-readyState.html is a flaky failure
Modified: trunk/LayoutTests/fast/sandbox/mac/sandbox-mach-lookup-expected.txt (259752 => 259753)
--- trunk/LayoutTests/fast/sandbox/mac/sandbox-mach-lookup-expected.txt 2020-04-08 20:14:50 UTC (rev 259752)
+++ trunk/LayoutTests/fast/sandbox/mac/sandbox-mach-lookup-expected.txt 2020-04-08 20:15:58 UTC (rev 259753)
@@ -8,5 +8,4 @@
PASS internals.hasSandboxMachLookupAccessToGlobalName("com.apple.WebKit.WebContent", "com.apple.nesessionmanager") is false
PASS internals.hasSandboxMachLookupAccessToGlobalName("com.apple.WebKit.WebContent", "com.apple.nesessionmanager.content-filter") is false
PASS internals.hasSandboxMachLookupAccessToGlobalName("com.apple.WebKit.WebContent", "com.apple.system.logger") is false
-PASS internals.hasSandboxMachLookupAccessToGlobalName("com.apple.WebKit.WebContent", "com.apple.lsd.mapdb") is false
Modified: trunk/LayoutTests/fast/sandbox/mac/sandbox-mach-lookup.html (259752 => 259753)
--- trunk/LayoutTests/fast/sandbox/mac/sandbox-mach-lookup.html 2020-04-08 20:14:50 UTC (rev 259752)
+++ trunk/LayoutTests/fast/sandbox/mac/sandbox-mach-lookup.html 2020-04-08 20:15:58 UTC (rev 259753)
@@ -11,7 +11,6 @@
shouldBeFalse("internals.hasSandboxMachLookupAccessToGlobalName(\"com.apple.WebKit.WebContent\", \"com.apple.nesessionmanager\")");
shouldBeFalse("internals.hasSandboxMachLookupAccessToGlobalName(\"com.apple.WebKit.WebContent\", \"com.apple.nesessionmanager.content-filter\")");
shouldBeFalse("internals.hasSandboxMachLookupAccessToGlobalName(\"com.apple.WebKit.WebContent\", \"com.apple.system.logger\")");
- shouldBeFalse("internals.hasSandboxMachLookupAccessToGlobalName(\"com.apple.WebKit.WebContent\", \"com.apple.lsd.mapdb\")");
}
</script>
</head>
Modified: trunk/Source/WebKit/ChangeLog (259752 => 259753)
--- trunk/Source/WebKit/ChangeLog 2020-04-08 20:14:50 UTC (rev 259752)
+++ trunk/Source/WebKit/ChangeLog 2020-04-08 20:15:58 UTC (rev 259753)
@@ -1,3 +1,19 @@
+2020-04-08 Per Arne Vollan <[email protected]>
+
+ [macOS] Crash under WebKit::SandboxExtension::consume
+ https://bugs.webkit.org/show_bug.cgi?id=210188
+
+ Reviewed by Geoffrey Garen.
+
+ When issuing a mach lookup extension to the database mapping service in the UI process fails, the WebContent
+ process will crash when trying to consume the extension.
+
+ No new tests, since I am not able to reproduce the issue.
+
+ * UIProcess/Cocoa/WebProcessPoolCocoa.mm:
+ (WebKit::WebProcessPool::platformInitializeWebProcess):
+ * WebProcess/com.apple.WebProcess.sb.in:
+
2020-04-08 Rob Buis <[email protected]>
Make more use of FrameLoader pageID/frameID getters
Modified: trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm (259752 => 259753)
--- trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm 2020-04-08 20:14:50 UTC (rev 259752)
+++ trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm 2020-04-08 20:15:58 UTC (rev 259753)
@@ -411,8 +411,8 @@
parameters.mimeTypesMap = commonMimeTypesMap();
SandboxExtension::Handle mapDBHandle;
- SandboxExtension::createHandleForMachLookup("com.apple.lsd.mapdb", WTF::nullopt, mapDBHandle, SandboxExtension::Flags::NoReport);
- parameters.mapDBExtensionHandle = WTFMove(mapDBHandle);
+ if (SandboxExtension::createHandleForMachLookup("com.apple.lsd.mapdb", WTF::nullopt, mapDBHandle, SandboxExtension::Flags::NoReport))
+ parameters.mapDBExtensionHandle = WTFMove(mapDBHandle);
#endif
#if PLATFORM(IOS)
Modified: trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in (259752 => 259753)
--- trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in 2020-04-08 20:14:50 UTC (rev 259752)
+++ trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in 2020-04-08 20:15:58 UTC (rev 259753)
@@ -687,9 +687,10 @@
(global-name "com.apple.trustd.agent")
)
-(deny mach-lookup
#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101600
- (with telemetry-backtrace)
+(deny mach-lookup (with telemetry-backtrace)
+#else
+(allow mach-lookup
#endif
(global-name "com.apple.lsd.mapdb")
)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
