Title: [152816] trunk/Source/WTF
Revision
152816
Author
benja...@webkit.org
Date
2013-07-17 16:37:54 -0700 (Wed, 17 Jul 2013)

Log Message

Add a thread safety assertion when creating an AtomicString from a StringImpl
https://bugs.webkit.org/show_bug.cgi?id=118637

Reviewed by Sam Weinig.

The goal is to prevent this kind of use:
-Someone create a String from a StringImpl.
-At some point, the string becomes atomic.
-Later, when the string only has one ref, its ownership is 'passed' to an other thread
 without checking String::isSafeToSendToAnotherThread().
-In the thread B, an AtomicString is created from the String.
->The AtomicString's StringImpl returned is not in the current thread string table.

* wtf/text/AtomicString.cpp:
(WTF::AtomicString::isInAtomicStringTable):
* wtf/text/AtomicString.h:
(WTF::AtomicString::add):

Modified Paths

Diff

Modified: trunk/Source/WTF/ChangeLog (152815 => 152816)


--- trunk/Source/WTF/ChangeLog	2013-07-17 23:34:13 UTC (rev 152815)
+++ trunk/Source/WTF/ChangeLog	2013-07-17 23:37:54 UTC (rev 152816)
@@ -1,5 +1,25 @@
 2013-07-17  Benjamin Poulain  <benja...@webkit.org>
 
+        Add a thread safety assertion when creating an AtomicString from a StringImpl
+        https://bugs.webkit.org/show_bug.cgi?id=118637
+
+        Reviewed by Sam Weinig.
+
+        The goal is to prevent this kind of use:
+        -Someone create a String from a StringImpl.
+        -At some point, the string becomes atomic.
+        -Later, when the string only has one ref, its ownership is 'passed' to an other thread
+         without checking String::isSafeToSendToAnotherThread().
+        -In the thread B, an AtomicString is created from the String.
+        ->The AtomicString's StringImpl returned is not in the current thread string table.
+
+        * wtf/text/AtomicString.cpp:
+        (WTF::AtomicString::isInAtomicStringTable):
+        * wtf/text/AtomicString.h:
+        (WTF::AtomicString::add):
+
+2013-07-17  Benjamin Poulain  <benja...@webkit.org>
+
         Simplify AtomicString::lower()
         https://bugs.webkit.org/show_bug.cgi?id=118719
         <rdar://problem/14452883>

Modified: trunk/Source/WTF/wtf/text/AtomicString.cpp (152815 => 152816)


--- trunk/Source/WTF/wtf/text/AtomicString.cpp	2013-07-17 23:34:13 UTC (rev 152815)
+++ trunk/Source/WTF/wtf/text/AtomicString.cpp	2013-07-17 23:37:54 UTC (rev 152816)
@@ -461,6 +461,14 @@
     return atomicString;
 }
 
+#if !ASSERT_DISABLED
+bool AtomicString::isInAtomicStringTable(StringImpl* string)
+{
+    AtomicStringTableLocker locker;
+    return stringTable().contains(string);
+}
+#endif
+
 #ifndef NDEBUG
 void AtomicString::show() const
 {

Modified: trunk/Source/WTF/wtf/text/AtomicString.h (152815 => 152816)


--- trunk/Source/WTF/wtf/text/AtomicString.h	2013-07-17 23:34:13 UTC (rev 152815)
+++ trunk/Source/WTF/wtf/text/AtomicString.h	2013-07-17 23:37:54 UTC (rev 152816)
@@ -182,11 +182,13 @@
     WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> add(const UChar*, unsigned length, unsigned existingHash);
     WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> add(const UChar*);
     WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> add(StringImpl*, unsigned offset, unsigned length);
-    ALWAYS_INLINE static PassRefPtr<StringImpl> add(StringImpl* r)
+    ALWAYS_INLINE static PassRefPtr<StringImpl> add(StringImpl* string)
     {
-        if (!r || r->isAtomic())
-            return r;
-        return addSlowCase(r);
+        if (!string || string->isAtomic()) {
+            ASSERT_WITH_MESSAGE(!string || isInAtomicStringTable(string), "The atomic string comes from an other thread!");
+            return string;
+        }
+        return addSlowCase(string);
     }
     WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> addFromLiteralData(const char* characters, unsigned length);
     WTF_EXPORT_STRING_API static PassRefPtr<StringImpl> addSlowCase(StringImpl*);
@@ -195,6 +197,10 @@
 #endif
 
     WTF_EXPORT_STRING_API static AtomicString fromUTF8Internal(const char*, const char*);
+
+#if !ASSERT_DISABLED
+    WTF_EXPORT_STRING_API static bool isInAtomicStringTable(StringImpl*);
+#endif
 };
 
 inline bool operator==(const AtomicString& a, const AtomicString& b) { return a.impl() == b.impl(); }
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to