Changeset 202922 in webkit

Timestamp:

Jul 7, 2016, 11:47:51 AM (10 years ago)

Author:

andersca@apple.com

Message:

Memory corruption destroying PaymentCoordinator
​https://bugs.webkit.org/show_bug.cgi?id=159516
rdar://problem/27222857

Reviewed by Tim Horton.

Introduce a new MessageReceiverMap::removeMessageReceiver that takes a MessageReceiver
and removes all traces of it in the message receiver map. Use it in the WebPaymentCoordinator destructor.

• Platform/IPC/MessageReceiverMap.cpp:

(IPC::MessageReceiverMap::removeMessageReceiver):

• Platform/IPC/MessageReceiverMap.h:
• Shared/ChildProcess.cpp:

(WebKit::ChildProcess::removeMessageReceiver):

• Shared/ChildProcess.h:
• WebProcess/ApplePay/WebPaymentCoordinator.cpp:

(WebKit::WebPaymentCoordinator::~WebPaymentCoordinator):

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• Platform/IPC/MessageReceiverMap.cpp (modified) (1 diff)
• Platform/IPC/MessageReceiverMap.h (modified) (1 diff)
• Shared/ChildProcess.cpp (modified) (1 diff)
• Shared/ChildProcess.h (modified) (1 diff)
• WebProcess/ApplePay/WebPaymentCoordinator.cpp (modified) (1 diff)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2016-07-07  Anders Carlsson  <andersca@apple.com>
+
+        Memory corruption destroying PaymentCoordinator
+        https://bugs.webkit.org/show_bug.cgi?id=159516
+        rdar://problem/27222857
+
+        Reviewed by Tim Horton.
+
+        Introduce a new MessageReceiverMap::removeMessageReceiver that takes a MessageReceiver
+        and removes all traces of it in the message receiver map. Use it in the WebPaymentCoordinator destructor.
+
+        * Platform/IPC/MessageReceiverMap.cpp:
+        (IPC::MessageReceiverMap::removeMessageReceiver):
+        * Platform/IPC/MessageReceiverMap.h:
+        * Shared/ChildProcess.cpp:
+        (WebKit::ChildProcess::removeMessageReceiver):
+        * Shared/ChildProcess.h:
+        * WebProcess/ApplePay/WebPaymentCoordinator.cpp:
+        (WebKit::WebPaymentCoordinator::~WebPaymentCoordinator):
+
 2016-07-07  Csaba Osztrogonác  <ossy@webkit.org>
 

trunk/Source/WebKit2/Platform/IPC/MessageReceiverMap.cpp

@@ -78 +78 @@
 }
 
+void MessageReceiverMap::removeMessageReceiver(MessageReceiver& messageReceiver)
+{
+    Vector<StringReference> globalReceiversToRemove;
+    for (auto& nameAndReceiver : m_globalMessageReceivers) {
+        if (nameAndReceiver.value == &messageReceiver)
+            globalReceiversToRemove.append(nameAndReceiver.key);
+    }
+
+    for (auto& globalReceiverToRemove : globalReceiversToRemove)
+        removeMessageReceiver(globalReceiverToRemove);
+
+    Vector<std::pair<StringReference, uint64_t>> receiversToRemove;
+    for (auto& nameAndIdAndReceiver : m_messageReceivers) {
+        if (nameAndIdAndReceiver.value == &messageReceiver)
+            receiversToRemove.append(std::make_pair(nameAndIdAndReceiver.key.first, nameAndIdAndReceiver.key.second));
+    }
+
+    for (auto& receiverToRemove : receiversToRemove)
+        removeMessageReceiver(receiverToRemove.first, receiverToRemove.second);
+}
+
 void MessageReceiverMap::invalidate()
 {

trunk/Source/WebKit2/Platform/IPC/MessageReceiverMap.h

@@ -48 +48 @@
     void removeMessageReceiver(StringReference messageReceiverName);
     void removeMessageReceiver(StringReference messageReceiverName, uint64_t destinationID);
+    void removeMessageReceiver(MessageReceiver&);
 
     void invalidate();

trunk/Source/WebKit2/Shared/ChildProcess.cpp

@@ -121 +121 @@
 }
 
+void ChildProcess::removeMessageReceiver(IPC::MessageReceiver& messageReceiver)
+{
+    m_messageReceiverMap.removeMessageReceiver(messageReceiver);
+}
+
 void ChildProcess::disableTermination()
 {

trunk/Source/WebKit2/Shared/ChildProcess.h

@@ -66 +66 @@
     void removeMessageReceiver(IPC::StringReference messageReceiverName, uint64_t destinationID);
     void removeMessageReceiver(IPC::StringReference messageReceiverName);
+    void removeMessageReceiver(IPC::MessageReceiver&);
 
     void setProcessSuppressionEnabled(bool);

trunk/Source/WebKit2/WebProcess/ApplePay/WebPaymentCoordinator.cpp

@@ -48 +48 @@
 WebPaymentCoordinator::~WebPaymentCoordinator()
 {
-    WebProcess::singleton().removeMessageReceiver(Messages::WebPaymentCoordinator::messageReceiverName(), m_webPage.pageID());
+    WebProcess::singleton().removeMessageReceiver(*this);
 }