Title: [199416] releases/WebKitGTK/webkit-2.12/Source/WebCore
- Revision
- 199416
- Author
- [email protected]
- Date
- 2016-04-12 23:53:04 -0700 (Tue, 12 Apr 2016)
Log Message
Merge r198387 - Data URL DecodeTask may get deleted outside main thread
https://bugs.webkit.org/show_bug.cgi?id=155584
rdar://problem/24492104
Reviewed by Darin Adler.
This is unsafe as it owns strings and other types that are only safe to delete in the main thread.
There is a race between deref in dispatch() and deref in timerFired(). If the timer fires before dispatch()
exits the implicit deref will trigger deletion of DecodingResultDispatcher in the dispatching thread.
(WebCore::DataURLDecoder::DecodingResultDispatcher::timerFired):
Fix by clearing m_decodeTask when the timer fires.
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog (199415 => 199416)
--- releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog 2016-04-13 06:51:26 UTC (rev 199415)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog 2016-04-13 06:53:04 UTC (rev 199416)
@@ -1,3 +1,20 @@
+2016-03-17 Antti Koivisto <[email protected]>
+
+ Data URL DecodeTask may get deleted outside main thread
+ https://bugs.webkit.org/show_bug.cgi?id=155584
+ rdar://problem/24492104
+
+ Reviewed by Darin Adler.
+
+ This is unsafe as it owns strings and other types that are only safe to delete in the main thread.
+
+ There is a race between deref in dispatch() and deref in timerFired(). If the timer fires before dispatch()
+ exits the implicit deref will trigger deletion of DecodingResultDispatcher in the dispatching thread.
+
+ (WebCore::DataURLDecoder::DecodingResultDispatcher::timerFired):
+
+ Fix by clearing m_decodeTask when the timer fires.
+
2016-03-17 Brent Fulgham <[email protected]>
[XSS Auditor] Off by one in XSSAuditor::canonicalizedSnippetForJavaScript()
Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/network/DataURLDecoder.cpp (199415 => 199416)
--- releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/network/DataURLDecoder.cpp 2016-04-13 06:51:26 UTC (rev 199415)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/network/DataURLDecoder.cpp 2016-04-13 06:53:04 UTC (rev 199416)
@@ -86,6 +86,9 @@
else
m_decodeTask->completionHandler({ });
+ // Ensure DecodeTask gets deleted in the main thread.
+ m_decodeTask = nullptr;
+
deref();
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
