Changeset 293736 in webkit

Timestamp:

May 3, 2022, 1:18:02 PM (4 years ago)

Author:

sihui_liu@apple.com

Message:

StorageMap::removeItem may fail to remove item from map
​https://bugs.webkit.org/show_bug.cgi?id=239982
rdar://80891555

Reviewed by Chris Dumez.

Source/WebCore:

We may have updated m_impl, but we don't update iterator for removal. In this case, item is not removed from
map, but currentSize is updated. The mismatch between currentSize and actual size of the map may lead to
underflow and overflow in currentSize when item is added or removed later.

Test: storage/domstorage/sessionstorage/window-open-remove-item.html

• storage/StorageMap.cpp:

(WebCore::StorageMap::removeItem):

LayoutTests:

• storage/domstorage/sessionstorage/resources/window-open-remove-item.html: Added.
• storage/domstorage/sessionstorage/window-open-remove-item-expected.txt: Added.
• storage/domstorage/sessionstorage/window-open-remove-item.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/storage/domstorage/sessionstorage/resources/window-open-remove-item.html (added)
• LayoutTests/storage/domstorage/sessionstorage/window-open-remove-item-expected.txt (added)
• LayoutTests/storage/domstorage/sessionstorage/window-open-remove-item.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/storage/StorageMap.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2022-05-03  Sihui Liu  <sihui_liu@apple.com>
+
+        StorageMap::removeItem may fail to remove item from map
+        https://bugs.webkit.org/show_bug.cgi?id=239982
+        rdar://80891555
+
+        Reviewed by Chris Dumez.
+
+        * storage/domstorage/sessionstorage/resources/window-open-remove-item.html: Added.
+        * storage/domstorage/sessionstorage/window-open-remove-item-expected.txt: Added.
+        * storage/domstorage/sessionstorage/window-open-remove-item.html: Added.
+
 2022-05-03  Robert Jenner  <Jenner@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2022-05-03  Sihui Liu  <sihui_liu@apple.com>
+
+        StorageMap::removeItem may fail to remove item from map
+        https://bugs.webkit.org/show_bug.cgi?id=239982
+        rdar://80891555
+
+        Reviewed by Chris Dumez.
+
+        We may have updated m_impl, but we don't update iterator for removal. In this case, item is not removed from
+        map, but currentSize is updated. The mismatch between currentSize and actual size of the map may lead to
+        underflow and overflow in currentSize when item is added or removed later.
+
+        Test: storage/domstorage/sessionstorage/window-open-remove-item.html
+
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::removeItem):
+
 2022-05-03  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/storage/StorageMap.cpp

@@ -139 +139 @@
         m_impl = m_impl->copy();
 
-    m_impl->map.remove(iter);
+    m_impl->map.remove(key);
     m_impl->currentSize = newSize;
     invalidateIterator();