Title: [282241] trunk/Source/WebCore
- Revision
- 282241
- Author
- [email protected]
- Date
- 2021-09-09 15:24:42 -0700 (Thu, 09 Sep 2021)
Log Message
Potential crash under CachedRawResource::didAddClient()
https://bugs.webkit.org/show_bug.cgi?id=230121
<rdar://82936913>
Reviewed by Alex Christensen.
In r280083, I tried to address this crash by holding a strong reference
to the SharedBuffer before calling forEachSegment() on it. However, the
crash is still happening after this fix.
My suspicion is that the SharedBuffer's internal m_segments vector gets
modified as we iterate over it. As a result, I am reverting r280083 and
iterating over a copy of m_segments in forEachSegment() instead.
No new tests, we haven't been able to reproduce.
* WebCore.xcodeproj/project.pbxproj:
* loader/cache/CachedRawResource.cpp:
(WebCore::CachedRawResource::didAddClient):
* platform/SharedBuffer.cpp:
(WebCore::SharedBuffer::forEachSegment const):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (282240 => 282241)
--- trunk/Source/WebCore/ChangeLog 2021-09-09 21:57:32 UTC (rev 282240)
+++ trunk/Source/WebCore/ChangeLog 2021-09-09 22:24:42 UTC (rev 282241)
@@ -1,3 +1,27 @@
+2021-09-09 Chris Dumez <[email protected]>
+
+ Potential crash under CachedRawResource::didAddClient()
+ https://bugs.webkit.org/show_bug.cgi?id=230121
+ <rdar://82936913>
+
+ Reviewed by Alex Christensen.
+
+ In r280083, I tried to address this crash by holding a strong reference
+ to the SharedBuffer before calling forEachSegment() on it. However, the
+ crash is still happening after this fix.
+
+ My suspicion is that the SharedBuffer's internal m_segments vector gets
+ modified as we iterate over it. As a result, I am reverting r280083 and
+ iterating over a copy of m_segments in forEachSegment() instead.
+
+ No new tests, we haven't been able to reproduce.
+
+ * WebCore.xcodeproj/project.pbxproj:
+ * loader/cache/CachedRawResource.cpp:
+ (WebCore::CachedRawResource::didAddClient):
+ * platform/SharedBuffer.cpp:
+ (WebCore::SharedBuffer::forEachSegment const):
+
2021-09-09 Fujii Hironori <[email protected]>
[Win] REGRESSION(r282123): some layout tests are failing because the bgcolor of text input forms are unexpectedly black
Modified: trunk/Source/WebCore/loader/cache/CachedRawResource.cpp (282240 => 282241)
--- trunk/Source/WebCore/loader/cache/CachedRawResource.cpp 2021-09-09 21:57:32 UTC (rev 282240)
+++ trunk/Source/WebCore/loader/cache/CachedRawResource.cpp 2021-09-09 22:24:42 UTC (rev 282241)
@@ -167,8 +167,8 @@
auto responseProcessedHandler = [this, protectedThis = WTFMove(protectedThis), client] {
if (!hasClient(*client))
return;
- if (auto data = "" {
- data->forEachSegment([&](auto& segment) {
+ if (m_data) {
+ m_data->forEachSegment([&](auto& segment) {
if (hasClient(*client))
client->dataReceived(*this, segment.data(), segment.size());
});
Modified: trunk/Source/WebCore/platform/SharedBuffer.cpp (282240 => 282241)
--- trunk/Source/WebCore/platform/SharedBuffer.cpp 2021-09-09 21:57:32 UTC (rev 282240)
+++ trunk/Source/WebCore/platform/SharedBuffer.cpp 2021-09-09 22:24:42 UTC (rev 282241)
@@ -238,7 +238,8 @@
void SharedBuffer::forEachSegment(const Function<void(const Span<const uint8_t>&)>& apply) const
{
- for (auto& segment : m_segments)
+ auto segments = m_segments;
+ for (auto& segment : segments)
apply(Span { segment.segment->data(), segment.segment->size() });
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
