Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 56909e17f99a6561d2b9cf760a9f68f705dbaad3
https://github.com/WebKit/WebKit/commit/56909e17f99a6561d2b9cf760a9f68f705dbaad3
Author: Charlie Wolfe <[email protected]>
Date: 2026-09-15 (Tue, 15 Sep 2026)
Changed paths:
A
LayoutTests/http/tests/site-isolation/indexeddb-file-posted-to-cross-origin-iframe-expected.txt
A
LayoutTests/http/tests/site-isolation/indexeddb-file-posted-to-cross-origin-iframe.html
A LayoutTests/http/tests/site-isolation/resources/read-posted-file.html
A
LayoutTests/http/tests/workers/service/indexeddb-file-broadcast-after-release-expected.txt
A
LayoutTests/http/tests/workers/service/indexeddb-file-broadcast-after-release.html
A
LayoutTests/http/tests/workers/service/indexeddb-file-posted-to-message-port-after-release-expected.txt
A
LayoutTests/http/tests/workers/service/indexeddb-file-posted-to-message-port-after-release.html
A
LayoutTests/http/tests/workers/service/indexeddb-file-posted-to-message-port-in-transit-expected.txt
A
LayoutTests/http/tests/workers/service/indexeddb-file-posted-to-message-port-in-transit.html
A
LayoutTests/http/tests/workers/service/indexeddb-file-postmessage-from-service-worker-expected.txt
A
LayoutTests/http/tests/workers/service/indexeddb-file-postmessage-from-service-worker.html
A
LayoutTests/http/tests/workers/service/indexeddb-file-postmessage-to-service-worker-after-release-expected.txt
A
LayoutTests/http/tests/workers/service/indexeddb-file-postmessage-to-service-worker-after-release.html
A
LayoutTests/http/tests/workers/service/resources/indexeddb-file-blob-retention-worker.js
A
LayoutTests/http/tests/workers/service/resources/indexeddb-file-broadcast-after-release.js
A
LayoutTests/http/tests/workers/service/resources/indexeddb-file-broadcast-receiver-worker.js
A
LayoutTests/http/tests/workers/service/resources/indexeddb-file-posted-to-message-port-after-release.js
A
LayoutTests/http/tests/workers/service/resources/indexeddb-file-posted-to-message-port-in-transit.js
A
LayoutTests/http/tests/workers/service/resources/indexeddb-file-postmessage-from-service-worker.js
A
LayoutTests/http/tests/workers/service/resources/indexeddb-file-postmessage-to-service-worker-after-release.js
A
LayoutTests/http/tests/workers/service/resources/indexeddb-file-postmessage-worker.js
A LayoutTests/http/tests/workers/service/resources/indexeddb-file.js
M LayoutTests/ipc/register-file-backed-blob-path-validation-expected.txt
M LayoutTests/ipc/register-file-backed-blob-path-validation.html
M Source/WTF/wtf/CompletionHandler.h
M Source/WebCore/bindings/js/SerializedScriptValue.h
M Source/WebCore/dom/BroadcastChannel.cpp
M Source/WebCore/dom/BroadcastChannel.h
M Source/WebCore/dom/messageports/MessagePortChannel.cpp
M Source/WebCore/dom/messageports/MessagePortChannel.h
M Source/WebCore/dom/messageports/MessagePortChannelRegistry.cpp
M Source/WebCore/dom/messageports/MessagePortChannelRegistry.h
M Source/WebCore/workers/service/SWClientConnection.cpp
M Source/WebCore/workers/service/SWClientConnection.h
M Source/WebCore/workers/service/context/ServiceWorkerThread.cpp
M Source/WebCore/workers/service/context/ServiceWorkerThread.h
M Source/WebCore/workers/service/context/ServiceWorkerThreadProxy.cpp
M Source/WebCore/workers/service/context/ServiceWorkerThreadProxy.h
M Source/WebCore/workers/service/server/SWServer.h
M Source/WebKit/NetworkProcess/NetworkBroadcastChannelRegistry.cpp
M Source/WebKit/NetworkProcess/NetworkBroadcastChannelRegistry.h
M Source/WebKit/NetworkProcess/NetworkBroadcastChannelRegistry.messages.in
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.messages.in
M Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerConnection.cpp
M Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerConnection.h
M
Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerConnection.messages.in
M
Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerToContextConnection.cpp
M
Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerToContextConnection.h
M
Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerToContextConnection.messages.in
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/WebProcess/Storage/WebSWClientConnection.cpp
M Source/WebKit/WebProcess/Storage/WebSWClientConnection.h
M Source/WebKit/WebProcess/Storage/WebSWClientConnection.messages.in
M Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.cpp
M Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.h
M Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.messages.in
M Source/WebKit/WebProcess/WebCoreSupport/WebBroadcastChannelRegistry.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebMessagePortChannelProvider.cpp
Log Message:
-----------
Incorrect process termination when a file-backed blob is posted to another
process
https://bugs.webkit.org/show_bug.cgi?id=323451
rdar://185042914
Reviewed by Sihui Liu.
When a message carrying a file-backed blob URL is posted across processes, the
destination process
re-registers the blob URL with the file path it was serialized with. That
process has no access to
the file, so the path check in
NetworkConnectionToWebProcess::registerInternalBlobURLOptionallyFileBacked
failed and its MESSAGE_CHECK terminated the destination web process.
Registering with a disallowed file path is no longer fatal. If the srcURL is
still registered, the
blob URL is registered as an alias of it without the file backing.
For that fallback to work, the source blob URL must outlive the message. The
network process now
takes a blob URL handle on each blob URL carried by a message and releases it
once the destination
has dispatched the message. This is plumbed through postMessage to and from
service workers,
MessagePort messages, and BroadcastChannel.
Tests:
http/tests/site-isolation/indexeddb-file-posted-to-cross-origin-iframe.html
http/tests/workers/service/indexeddb-file-broadcast-after-release.html
http/tests/workers/service/indexeddb-file-posted-to-message-port-after-release.html
http/tests/workers/service/indexeddb-file-posted-to-message-port-in-transit.html
http/tests/workers/service/indexeddb-file-postmessage-from-service-worker.html
http/tests/workers/service/indexeddb-file-postmessage-to-service-worker-after-release.html
*
LayoutTests/http/tests/site-isolation/indexeddb-file-posted-to-cross-origin-iframe-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/indexeddb-file-posted-to-cross-origin-iframe.html:
Added.
* LayoutTests/http/tests/site-isolation/resources/read-posted-file.html: Added.
*
LayoutTests/http/tests/workers/service/indexeddb-file-broadcast-after-release-expected.txt:
Added.
*
LayoutTests/http/tests/workers/service/indexeddb-file-broadcast-after-release.html:
Added.
*
LayoutTests/http/tests/workers/service/indexeddb-file-posted-to-message-port-after-release-expected.txt:
Added.
*
LayoutTests/http/tests/workers/service/indexeddb-file-posted-to-message-port-after-release.html:
Added.
*
LayoutTests/http/tests/workers/service/indexeddb-file-posted-to-message-port-in-transit-expected.txt:
Added.
*
LayoutTests/http/tests/workers/service/indexeddb-file-posted-to-message-port-in-transit.html:
Added.
*
LayoutTests/http/tests/workers/service/indexeddb-file-postmessage-from-service-worker-expected.txt:
Added.
*
LayoutTests/http/tests/workers/service/indexeddb-file-postmessage-from-service-worker.html:
Added.
*
LayoutTests/http/tests/workers/service/indexeddb-file-postmessage-to-service-worker-after-release-expected.txt:
Added.
*
LayoutTests/http/tests/workers/service/indexeddb-file-postmessage-to-service-worker-after-release.html:
Added.
*
LayoutTests/http/tests/workers/service/resources/indexeddb-file-blob-retention-worker.js:
Added.
(onmessage.heldPort.onmessage.async event):
(onmessage):
*
LayoutTests/http/tests/workers/service/resources/indexeddb-file-broadcast-after-release.js:
Added.
(async doTest):
*
LayoutTests/http/tests/workers/service/resources/indexeddb-file-broadcast-receiver-worker.js:
Added.
(broadcastChannel.onmessage.async event):
*
LayoutTests/http/tests/workers/service/resources/indexeddb-file-posted-to-message-port-after-release.js:
Added.
(async doTest):
*
LayoutTests/http/tests/workers/service/resources/indexeddb-file-posted-to-message-port-in-transit.js:
Added.
(async doTest):
*
LayoutTests/http/tests/workers/service/resources/indexeddb-file-postmessage-from-service-worker.js:
Added.
(async event):
(async doTest):
*
LayoutTests/http/tests/workers/service/resources/indexeddb-file-postmessage-to-service-worker-after-release.js:
Added.
(async doTest):
*
LayoutTests/http/tests/workers/service/resources/indexeddb-file-postmessage-worker.js:
Added.
(requestPromise):
(async fileFromIndexedDB):
(onmessage.async try):
* LayoutTests/http/tests/workers/service/resources/indexeddb-file.js: Added.
(indexedDBRequestPromise):
(async fileFromIndexedDB):
(async readPostedFile):
(blockServiceWorker):
(async releaseFile):
* LayoutTests/ipc/register-file-backed-blob-path-validation-expected.txt:
* LayoutTests/ipc/register-file-backed-blob-path-validation.html:
* Source/WTF/wtf/CompletionHandler.h:
* Source/WebCore/bindings/js/SerializedScriptValue.h:
* Source/WebCore/dom/BroadcastChannel.cpp:
(WebCore::BroadcastChannel::dispatchMessageTo):
(WebCore::BroadcastChannel::dispatchMessage):
* Source/WebCore/dom/BroadcastChannel.h:
* Source/WebCore/dom/messageports/MessagePortChannel.cpp:
(WebCore::MessagePortChannel::closePort):
(WebCore::MessagePortChannel::postMessageToRemote):
(WebCore::MessagePortChannel::takeAllMessagesForPort):
* Source/WebCore/dom/messageports/MessagePortChannel.h:
* Source/WebCore/dom/messageports/MessagePortChannelRegistry.cpp:
(WebCore::MessagePortChannelRegistry::didPostMessageToRemote):
* Source/WebCore/dom/messageports/MessagePortChannelRegistry.h:
* Source/WebCore/workers/service/SWClientConnection.cpp:
(WebCore::SWClientConnection::dispatchMessageToServiceWorkerClient):
* Source/WebCore/workers/service/SWClientConnection.h:
* Source/WebCore/workers/service/context/ServiceWorkerThread.cpp:
(WebCore::ServiceWorkerThread::queueTaskToPostMessage):
* Source/WebCore/workers/service/context/ServiceWorkerThread.h:
* Source/WebCore/workers/service/context/ServiceWorkerThreadProxy.cpp:
(WebCore::ServiceWorkerThreadProxy::fireMessageEvent):
* Source/WebCore/workers/service/context/ServiceWorkerThreadProxy.h:
* Source/WebCore/workers/service/server/SWServer.h:
* Source/WebKit/NetworkProcess/NetworkBroadcastChannelRegistry.cpp:
(WebKit::NetworkBroadcastChannelRegistry::postMessage):
* Source/WebKit/NetworkProcess/NetworkBroadcastChannelRegistry.h:
* Source/WebKit/NetworkProcess/NetworkBroadcastChannelRegistry.messages.in:
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::registerInternalBlobURLOptionallyFileBacked):
(WebKit::NetworkConnectionToWebProcess::ownsBlobURL const):
(WebKit::NetworkConnectionToWebProcess::retainBlobURLsWhileMessageIsInFlight):
(WebKit::NetworkConnectionToWebProcess::postMessageToRemote):
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h:
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.messages.in:
* Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerConnection.cpp:
(WebKit::WebSWServerConnection::resolveUnregistrationJobInClient):
(WebKit::WebSWServerConnection::postMessageToServiceWorkerClient):
* Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerConnection.h:
* Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerConnection.messages.in:
* Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerToContextConnection.cpp:
(WebKit::WebSWServerToContextConnection::postMessageToServiceWorkerClient):
* Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerToContextConnection.h:
*
Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerToContextConnection.messages.in:
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::postMessageToRemote):
* Source/WebKit/WebProcess/Storage/WebSWClientConnection.cpp:
(WebKit::WebSWClientConnection::postMessageToServiceWorker):
(WebKit::WebSWClientConnection::postMessageToServiceWorkerClient):
(WebKit::WebSWClientConnection::postMessageToServiceWorkerClientAndNotifyWhenDispatched):
* Source/WebKit/WebProcess/Storage/WebSWClientConnection.h:
* Source/WebKit/WebProcess/Storage/WebSWClientConnection.messages.in:
* Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.cpp:
(WebKit::WebSWContextManagerConnection::postMessageToServiceWorker):
(WebKit::WebSWContextManagerConnection::postMessageToServiceWorkerAndNotifyWhenDispatched):
(WebKit::WebSWContextManagerConnection::postMessageToServiceWorkerInternal):
(WebKit::WebSWContextManagerConnection::postMessageToServiceWorkerClient):
* Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.h:
* Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.messages.in:
* Source/WebKit/WebProcess/WebCoreSupport/WebBroadcastChannelRegistry.cpp:
(WebKit::WebBroadcastChannelRegistry::postMessage):
* Source/WebKit/WebProcess/WebCoreSupport/WebMessagePortChannelProvider.cpp:
(WebKit::WebMessagePortChannelProvider::postMessageToRemote):
Canonical link: https://commits.webkit.org/321170@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
