Changeset 238553 in webkit

Timestamp:

Nov 27, 2018 7:51:43 AM (5 years ago)

Author:

Wenson Hsieh

Message:

WebKit.AddAndRemoveDataDetectors hits a debug assertion after r238515
​https://bugs.webkit.org/show_bug.cgi?id=191996

Reviewed by Tim Horton.

This assertion is hit because decode(Decoder& decoder, NSArray<Class> *allowedClasses) expects the decoded
object (of class _NSArrayM) to be equal to NSArray.class.

We fix the crash by relaxing the debug assertion when decoding securely-codable objects over IPC. Instead of
checking that the class of the decoded object is equal to one of the allowed classes, check that the object is a
kind of any of the allowed classes.

• Shared/Cocoa/ArgumentCodersCocoa.h:

(IPC::isObjectClassAllowed):
(IPC::decode):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Shared/Cocoa/ArgumentCodersCocoa.h (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2018-11-27  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        WebKit.AddAndRemoveDataDetectors hits a debug assertion after r238515
+        https://bugs.webkit.org/show_bug.cgi?id=191996
+
+        Reviewed by Tim Horton.
+
+        This assertion is hit because `decode(Decoder& decoder, NSArray<Class> *allowedClasses)` expects the decoded
+        object (of class `_NSArrayM`) to be equal to `NSArray.class`.
+
+        We fix the crash by relaxing the debug assertion when decoding securely-codable objects over IPC. Instead of
+        checking that the class of the decoded object is equal to one of the allowed classes, check that the object is a
+        kind of any of the allowed classes.
+
+        * Shared/Cocoa/ArgumentCodersCocoa.h:
+        (IPC::isObjectClassAllowed):
+        (IPC::decode):
+
 2018-11-27  Tomas Popela  <tpopela@redhat.com>
 

trunk/Source/WebKit/Shared/Cocoa/ArgumentCodersCocoa.h

@@ -44 +44 @@
 }
 
+#ifndef NDEBUG
+
+static inline bool isObjectClassAllowed(id object, NSArray<Class> *allowedClasses)
+{
+    for (Class allowedClass in allowedClasses) {
+        if ([object isKindOfClass:allowedClass])
+            return true;
+    }
+    return false;
+}
+
+#endif
+
 template<typename T>
 std::optional<RetainPtr<T>> decode(Decoder& decoder, NSArray<Class> *allowedClasses)
@@ -55 +68 @@
 
     id object = result->leakRef();
-    ASSERT([allowedClasses containsObject:[object class]]);
+    ASSERT(isObjectClassAllowed(object, allowedClasses));
     return { adoptNS(static_cast<T *>(object)) };
 }