Title: [153614] branches/safari-537-branch/Source/WebKit2
- Revision
- 153614
- Author
- [email protected]
- Date
- 2013-08-01 15:15:34 -0700 (Thu, 01 Aug 2013)
Log Message
Merged r153499. <rdar://problem/14267833>
Modified Paths
Diff
Modified: branches/safari-537-branch/Source/WebKit2/ChangeLog (153613 => 153614)
--- branches/safari-537-branch/Source/WebKit2/ChangeLog 2013-08-01 22:14:28 UTC (rev 153613)
+++ branches/safari-537-branch/Source/WebKit2/ChangeLog 2013-08-01 22:15:34 UTC (rev 153614)
@@ -1,5 +1,29 @@
2013-08-01 Lucas Forschler <[email protected]>
+ Merge r153499
+
+ 2013-07-30 Anders Carlsson <[email protected]>
+
+ Speculative fix for crash due to string access on multiple threads
+ https://bugs.webkit.org/show_bug.cgi?id=119279
+ <rdar://problem/14267833>
+
+ Reviewed by Darin Adler.
+
+ We can't use String::isolatedCopy for passing the local storage directory to the storage thread since
+ that returns a String that's copied and then destroyed after the call to bind returns, leaving a small window
+ where the refcount can be accessed simultaneously from two threads.
+
+ Work around this by passing a PassRefPtr<StringImpl> to bind instead; the act of copying the PassRefPtr will
+ clear out the original and so when the original is destroyed the underlying StringImpl pointer will be null.
+
+ * UIProcess/Storage/LocalStorageDatabaseTracker.cpp:
+ (WebKit::LocalStorageDatabaseTracker::setLocalStorageDirectory):
+ (WebKit::LocalStorageDatabaseTracker::setLocalStorageDirectoryInternal):
+ * UIProcess/Storage/LocalStorageDatabaseTracker.h:
+
+2013-08-01 Lucas Forschler <[email protected]>
+
Merge r153488
2013-07-30 Anders Carlsson <[email protected]>
Modified: branches/safari-537-branch/Source/WebKit2/UIProcess/Storage/LocalStorageDatabaseTracker.cpp (153613 => 153614)
--- branches/safari-537-branch/Source/WebKit2/UIProcess/Storage/LocalStorageDatabaseTracker.cpp 2013-08-01 22:14:28 UTC (rev 153613)
+++ branches/safari-537-branch/Source/WebKit2/UIProcess/Storage/LocalStorageDatabaseTracker.cpp 2013-08-01 22:15:34 UTC (rev 153614)
@@ -52,7 +52,10 @@
void LocalStorageDatabaseTracker::setLocalStorageDirectory(const String& localStorageDirectory)
{
- m_queue->dispatch(bind(&LocalStorageDatabaseTracker::setLocalStorageDirectoryInternal, this, localStorageDirectory.isolatedCopy()));
+ // FIXME: We should come up with a better idiom for safely copying strings across threads.
+ RefPtr<StringImpl> copiedLocalStorageDirectory = localStorageDirectory.impl() ? localStorageDirectory.impl()->isolatedCopy() : nullptr;
+
+ m_queue->dispatch(bind(&LocalStorageDatabaseTracker::setLocalStorageDirectoryInternal, this, copiedLocalStorageDirectory.release()));
}
String LocalStorageDatabaseTracker::databasePath(SecurityOrigin* securityOrigin) const
@@ -129,7 +132,7 @@
return origins;
}
-void LocalStorageDatabaseTracker::setLocalStorageDirectoryInternal(const String& localStorageDirectory)
+void LocalStorageDatabaseTracker::setLocalStorageDirectoryInternal(StringImpl* localStorageDirectory)
{
if (m_database.isOpen())
m_database.close();
Modified: branches/safari-537-branch/Source/WebKit2/UIProcess/Storage/LocalStorageDatabaseTracker.h (153613 => 153614)
--- branches/safari-537-branch/Source/WebKit2/UIProcess/Storage/LocalStorageDatabaseTracker.h 2013-08-01 22:14:28 UTC (rev 153613)
+++ branches/safari-537-branch/Source/WebKit2/UIProcess/Storage/LocalStorageDatabaseTracker.h 2013-08-01 22:15:34 UTC (rev 153614)
@@ -59,7 +59,7 @@
private:
explicit LocalStorageDatabaseTracker(PassRefPtr<WorkQueue>);
- void setLocalStorageDirectoryInternal(const String&);
+ void setLocalStorageDirectoryInternal(StringImpl*);
String databasePath(const String& filename) const;
String trackerDatabasePath() const;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
