Changeset 254092 in webkit

Timestamp:

Jan 6, 2020, 3:32:31 PM (7 years ago)

Author:

commit-queue@webkit.org

Message:

NetworkSessionCocoa::isolatedSession should not use iterator after mutating m_isolatedSessions
​https://bugs.webkit.org/show_bug.cgi?id=205824
<rdar://problem/55107625>

Patch by Alex Christensen <​achristensen@webkit.org> on 2020-01-06
Reviewed by Chris Dumez.

Classic iterator use after mutating iterated container was causing crashes by returning a null SessionWrapper&
This was introduced in r252185 or r248640.

• NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(WebKit::NetworkSessionCocoa::isolatedSession):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• NetworkProcess/cocoa/NetworkSessionCocoa.mm (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2020-01-06  Alex Christensen  <achristensen@webkit.org>
+
+        NetworkSessionCocoa::isolatedSession should not use iterator after mutating m_isolatedSessions
+        https://bugs.webkit.org/show_bug.cgi?id=205824
+        <rdar://problem/55107625>
+
+        Reviewed by Chris Dumez.
+
+        Classic iterator use after mutating iterated container was causing crashes by returning a null SessionWrapper&
+        This was introduced in r252185 or r248640.
+
+        * NetworkProcess/cocoa/NetworkSessionCocoa.mm:
+        (WebKit::NetworkSessionCocoa::isolatedSession):
+
 2020-01-06  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm

@@ -1179 +1179 @@
     entry->lastUsed = WallTime::now();
 
+    auto& sessionWrapper = [&] (auto storedCredentialsPolicy) -> SessionWrapper& {
+        switch (storedCredentialsPolicy) {
+        case WebCore::StoredCredentialsPolicy::Use:
+            LOG(NetworkSession, "Using isolated NSURLSession with credential storage.");
+            return entry->sessionWithCredentialStorage;
+        case WebCore::StoredCredentialsPolicy::DoNotUse:
+            LOG(NetworkSession, "Using isolated NSURLSession without credential storage.");
+            return entry->sessionWithoutCredentialStorage;
+        case WebCore::StoredCredentialsPolicy::EphemeralStateless:
+            if (!m_ephemeralStatelessSession.session)
+                initializeEphemeralStatelessSession();
+            return m_ephemeralStatelessSession;
+        }
+    } (storedCredentialsPolicy);
+    
     if (m_isolatedSessions.size() > maxNumberOfIsolatedSessions) {
         WebCore::RegistrableDomain keyToRemove;
@@ -1195 +1210 @@
     RELEASE_ASSERT(m_isolatedSessions.size() <= maxNumberOfIsolatedSessions);
 
-    switch (storedCredentialsPolicy) {
-    case WebCore::StoredCredentialsPolicy::Use:
-        LOG(NetworkSession, "Using isolated NSURLSession with credential storage.");
-        return entry->sessionWithCredentialStorage;
-    case WebCore::StoredCredentialsPolicy::DoNotUse:
-        LOG(NetworkSession, "Using isolated NSURLSession without credential storage.");
-        return entry->sessionWithoutCredentialStorage;
-    case WebCore::StoredCredentialsPolicy::EphemeralStateless:
-        if (!m_ephemeralStatelessSession.session)
-            initializeEphemeralStatelessSession();
-        return m_ephemeralStatelessSession;
-    }
+    return sessionWrapper;
 }