Changeset 264018 in webkit

Timestamp:

Jul 7, 2020, 8:20:09 AM (6 years ago)

Author:

beidson@apple.com

Message:

Fix CrashTracer reported in PDFPlugin::ByteRangeRequest::maybeComplete.
<rdar://problem/64884982> and ​https://bugs.webkit.org/show_bug.cgi?id=214026

Reviewed by Tim Horton.

No new tests (CrashTracer with no reproduction)

Due to the racy-ness of how PDFKit calls us on the background thread vs. what might be
happening with the main thread, sometimes the main thread is asked to handle a data
request either:

• Before m_data is allocated or
• After it is deallocated

In either case it's okay to just not handle it.

Despite understanding how to reproduce in theory, writing a test case has been elusive.

• WebProcess/Plugins/PDF/PDFPlugin.mm:

(WebKit::PDFPlugin::ByteRangeRequest::maybeComplete): Null check m_data before doing anything with it.

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/Plugins/PDF/PDFPlugin.mm (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2020-07-07  Brady Eidson  <beidson@apple.com>
+
+        Fix CrashTracer reported in PDFPlugin::ByteRangeRequest::maybeComplete.
+        <rdar://problem/64884982> and https://bugs.webkit.org/show_bug.cgi?id=214026
+
+        Reviewed by Tim Horton.
+
+        No new tests (CrashTracer with no reproduction)
+        
+        Due to the racy-ness of how PDFKit calls us on the background thread vs. what might be
+        happening with the main thread, sometimes the main thread is asked to handle a data
+        request either:
+        - Before m_data is allocated
+          or
+        - After it is deallocated
+
+        In either case it's okay to just not handle it.
+
+        Despite understanding how to reproduce in theory, writing a test case has been elusive.
+        
+        * WebProcess/Plugins/PDF/PDFPlugin.mm:
+        (WebKit::PDFPlugin::ByteRangeRequest::maybeComplete): Null check m_data before doing anything with it.
+
 2020-07-07  Carlos Garcia Campos  <cgarcia@igalia.com>
 

trunk/Source/WebKit/WebProcess/Plugins/PDF/PDFPlugin.mm

@@ -1044 +1044 @@
 bool PDFPlugin::ByteRangeRequest::maybeComplete(PDFPlugin& plugin)
 {
+    if (!plugin.m_data)
+        return false;
+
     if (plugin.m_streamedBytes >= m_position + m_count) {
         completeWithBytes(CFDataGetBytePtr(plugin.m_data.get()) + m_position, m_count, plugin);
@@ -1056 +1059 @@
         return true;
     }
+
     return false;
 }