Changeset 271263 in webkit

Timestamp:

Jan 7, 2021, 3:09:45 PM (6 years ago)

Author:

commit-queue@webkit.org

Message:

Assertion failure in WebPageProxy::stopURLSchemeTask,
​https://bugs.webkit.org/show_bug.cgi?id=220401

Patch by Alex Christensen <​achristensen@webkit.org> on 2021-01-07
Reviewed by Ryosuke Niwa.

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::startURLSchemeTaskShared):
(WebKit::WebPageProxy::stopURLSchemeTask):
(WebKit::WebPageProxy::loadSynchronousURLSchemeTask):

• UIProcess/WebURLSchemeHandler.cpp:

(WebKit::WebURLSchemeHandler::processForTaskIdentifier const):
(WebKit::WebURLSchemeHandler::stopTask):
(WebKit::WebURLSchemeHandler::removeTaskFromPageMap):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/WebPageProxy.cpp (modified) (3 diffs)
• UIProcess/WebURLSchemeHandler.cpp (modified) (3 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-01-07  Alex Christensen  <achristensen@webkit.org>
+
+        Assertion failure in WebPageProxy::stopURLSchemeTask,
+        https://bugs.webkit.org/show_bug.cgi?id=220401
+
+        Reviewed by Ryosuke Niwa.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::startURLSchemeTaskShared):
+        (WebKit::WebPageProxy::stopURLSchemeTask):
+        (WebKit::WebPageProxy::loadSynchronousURLSchemeTask):
+        * UIProcess/WebURLSchemeHandler.cpp:
+        (WebKit::WebURLSchemeHandler::processForTaskIdentifier const):
+        (WebKit::WebURLSchemeHandler::stopTask):
+        (WebKit::WebURLSchemeHandler::removeTaskFromPageMap):
+
 2021-01-07  Andy Estes  <aestes@apple.com>
 

trunk/Source/WebKit/UIProcess/WebPageProxy.cpp

@@ -9545 +9545 @@
 void WebPageProxy::startURLSchemeTaskShared(Ref<WebProcessProxy>&& process, PageIdentifier webPageID, URLSchemeTaskParameters&& parameters)
 {
+    MESSAGE_CHECK(m_process, decltype(m_urlSchemeHandlersByIdentifier)::isValidKey(parameters.handlerIdentifier));
     auto iterator = m_urlSchemeHandlersByIdentifier.find(parameters.handlerIdentifier);
     MESSAGE_CHECK(process, iterator != m_urlSchemeHandlersByIdentifier.end());
@@ -9553 +9554 @@
 void WebPageProxy::stopURLSchemeTask(uint64_t handlerIdentifier, uint64_t taskIdentifier)
 {
+    MESSAGE_CHECK(m_process, decltype(m_urlSchemeHandlersByIdentifier)::isValidKey(handlerIdentifier));
     auto iterator = m_urlSchemeHandlersByIdentifier.find(handlerIdentifier);
     MESSAGE_CHECK(m_process, iterator != m_urlSchemeHandlersByIdentifier.end());
@@ -9561 +9563 @@
 void WebPageProxy::loadSynchronousURLSchemeTask(URLSchemeTaskParameters&& parameters, Messages::WebPageProxy::LoadSynchronousURLSchemeTask::DelayedReply&& reply)
 {
+    MESSAGE_CHECK(m_process, decltype(m_urlSchemeHandlersByIdentifier)::isValidKey(parameters.handlerIdentifier));
     auto iterator = m_urlSchemeHandlersByIdentifier.find(parameters.handlerIdentifier);
     MESSAGE_CHECK(m_process, iterator != m_urlSchemeHandlersByIdentifier.end());

trunk/Source/WebKit/UIProcess/WebURLSchemeHandler.cpp

@@ -65 +65 @@
 WebProcessProxy* WebURLSchemeHandler::processForTaskIdentifier(uint64_t taskIdentifier) const
 {
+    if (!decltype(m_tasks)::isValidKey(taskIdentifier))
+        return nullptr;
     auto iterator = m_tasks.find(taskIdentifier);
     if (iterator == m_tasks.end())
@@ -92 +94 @@
 void WebURLSchemeHandler::stopTask(WebPageProxy& page, uint64_t taskIdentifier)
 {
+    if (!decltype(m_tasks)::isValidKey(taskIdentifier))
+        return;
     auto iterator = m_tasks.find(taskIdentifier);
     if (iterator == m_tasks.end())
@@ -117 +121 @@
     ASSERT(iterator != m_tasksByPageIdentifier.end());
     ASSERT(iterator->value.contains(taskID));
+    if (!decltype(iterator->value)::isValidValue(taskID))
+        return;
     iterator->value.remove(taskID);
     if (iterator->value.isEmpty())