Changeset 243459 in webkit


Ignore:
Timestamp:
Mar 25, 2019 2:21:50 PM (5 years ago)
Author:
achristensen@apple.com
Message:

Stop storing raw pointers to Documents
​https://bugs.webkit.org/show_bug.cgi?id=196042

Reviewed by Geoff Garen.

Use WeakPtr instead! This could change some UAF bugs into null dereference crashes.

  • css/CSSFontSelector.cpp:

(WebCore::CSSFontSelector::CSSFontSelector):
(WebCore::CSSFontSelector::addFontFaceRule):
(WebCore::CSSFontSelector::fontRangesForFamily):

  • css/CSSFontSelector.h:
  • css/MediaQueryMatcher.cpp:

(WebCore::MediaQueryMatcher::MediaQueryMatcher):
(WebCore::MediaQueryMatcher::matchMedia):

  • css/MediaQueryMatcher.h:
  • css/StyleSheetList.cpp:

(WebCore::StyleSheetList::StyleSheetList):
(WebCore::StyleSheetList::ownerNode const):

  • css/StyleSheetList.h:
  • css/ViewportStyleResolver.cpp:

(WebCore::ViewportStyleResolver::ViewportStyleResolver):

  • css/ViewportStyleResolver.h:
  • dom/Document.h:

(WebCore::Document::setTemplateDocumentHost):
(WebCore::Document::templateDocumentHost):

  • dom/DocumentParser.cpp:

(WebCore::DocumentParser::DocumentParser):

  • dom/DocumentParser.h:

(WebCore::DocumentParser::document const):

  • dom/ScriptedAnimationController.cpp:

(WebCore::ScriptedAnimationController::ScriptedAnimationController):

  • dom/ScriptedAnimationController.h:
  • html/parser/HTMLScriptRunner.cpp:

(WebCore::HTMLScriptRunner::HTMLScriptRunner):
(WebCore::HTMLScriptRunner::runScript):

  • html/parser/HTMLScriptRunner.h:
  • loader/MediaResourceLoader.cpp:

(WebCore::MediaResourceLoader::MediaResourceLoader):

  • loader/MediaResourceLoader.h:
  • loader/cache/CachedResourceLoader.cpp:

(WebCore::CachedResourceLoader::canRequestInContentDispositionAttachmentSandbox const):
(WebCore::CachedResourceLoader::loadDone):

  • loader/cache/CachedResourceLoader.h:

(WebCore::CachedResourceLoader::document const):
(WebCore::CachedResourceLoader::setDocument):

Location:
trunk/Source/WebCore
Files:
20 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebCore/ChangeLog

    r243457 r243459  
     12019-03-25  Alex Christensen  <achristensen@webkit.org>
     2
     3        Stop storing raw pointers to Documents
     4        https://bugs.webkit.org/show_bug.cgi?id=196042
     5
     6        Reviewed by Geoff Garen.
     7
     8        Use WeakPtr instead!  This could change some UAF bugs into null dereference crashes.
     9
     10        * css/CSSFontSelector.cpp:
     11        (WebCore::CSSFontSelector::CSSFontSelector):
     12        (WebCore::CSSFontSelector::addFontFaceRule):
     13        (WebCore::CSSFontSelector::fontRangesForFamily):
     14        * css/CSSFontSelector.h:
     15        * css/MediaQueryMatcher.cpp:
     16        (WebCore::MediaQueryMatcher::MediaQueryMatcher):
     17        (WebCore::MediaQueryMatcher::matchMedia):
     18        * css/MediaQueryMatcher.h:
     19        * css/StyleSheetList.cpp:
     20        (WebCore::StyleSheetList::StyleSheetList):
     21        (WebCore::StyleSheetList::ownerNode const):
     22        * css/StyleSheetList.h:
     23        * css/ViewportStyleResolver.cpp:
     24        (WebCore::ViewportStyleResolver::ViewportStyleResolver):
     25        * css/ViewportStyleResolver.h:
     26        * dom/Document.h:
     27        (WebCore::Document::setTemplateDocumentHost):
     28        (WebCore::Document::templateDocumentHost):
     29        * dom/DocumentParser.cpp:
     30        (WebCore::DocumentParser::DocumentParser):
     31        * dom/DocumentParser.h:
     32        (WebCore::DocumentParser::document const):
     33        * dom/ScriptedAnimationController.cpp:
     34        (WebCore::ScriptedAnimationController::ScriptedAnimationController):
     35        * dom/ScriptedAnimationController.h:
     36        * html/parser/HTMLScriptRunner.cpp:
     37        (WebCore::HTMLScriptRunner::HTMLScriptRunner):
     38        (WebCore::HTMLScriptRunner::runScript):
     39        * html/parser/HTMLScriptRunner.h:
     40        * loader/MediaResourceLoader.cpp:
     41        (WebCore::MediaResourceLoader::MediaResourceLoader):
     42        * loader/MediaResourceLoader.h:
     43        * loader/cache/CachedResourceLoader.cpp:
     44        (WebCore::CachedResourceLoader::canRequestInContentDispositionAttachmentSandbox const):
     45        (WebCore::CachedResourceLoader::loadDone):
     46        * loader/cache/CachedResourceLoader.h:
     47        (WebCore::CachedResourceLoader::document const):
     48        (WebCore::CachedResourceLoader::setDocument):
     49
    1502019-03-25  Truitt Savell  <tsavell@apple.com>
    251

  • trunk/Source/WebCore/css/CSSFontSelector.cpp

    r241288 r243459  
    6363
    6464CSSFontSelector::CSSFontSelector(Document& document)
    65     : m_document(&document)
     65    : m_document(makeWeakPtr(document))
    6666    , m_cssFontFaceSet(CSSFontFaceSet::create(this))
    6767    , m_beginLoadingTimer(*this, &CSSFontSelector::beginLoadTimerFired)
    … …  
    208208        fontFace->setLoadingBehavior(*loadingBehavior);
    209209
    210     CSSFontFace::appendSources(fontFace, srcList, m_document, isInitiatingElementInUserAgentShadowTree);
     210    CSSFontFace::appendSources(fontFace, srcList, m_document.get(), isInitiatingElementInUserAgentShadowTree);
    211211    if (fontFace->computeFailureState())
    212212        return;
    … …  
    313313    bool resolveGenericFamilyFirst = familyName == standardFamily;
    314314
    315     AtomicString familyForLookup = resolveGenericFamilyFirst ? resolveGenericFamily(m_document, fontDescription, familyName) : familyName;
     315    AtomicString familyForLookup = resolveGenericFamilyFirst ? resolveGenericFamily(m_document.get(), fontDescription, familyName) : familyName;
    316316    auto* face = m_cssFontFaceSet->fontFace(fontDescription.fontSelectionRequest(), familyForLookup);
    317317    if (face) {
    … …  
    323323    }
    324324    if (!resolveGenericFamilyFirst)
    325         familyForLookup = resolveGenericFamily(m_document, fontDescription, familyName);
     325        familyForLookup = resolveGenericFamily(m_document.get(), fontDescription, familyName);
    326326    auto font = FontCache::singleton().fontForFamily(fontDescription, familyForLookup);
    327327    if (RuntimeEnabledFeatures::sharedFeatures().webAPIStatisticsEnabled()) {

  • trunk/Source/WebCore/css/CSSFontSelector.h

    r226930 r243459  
    7878    void unregisterForInvalidationCallbacks(FontSelectorClient&) final;
    7979
    80     Document* document() const { return m_document; }
     80    Document* document() const { return m_document.get(); }
    8181
    8282    void beginLoadingFontSoon(CachedFont&);
    … …  
    104104    Vector<PendingFontFaceRule> m_stagingArea;
    105105
    106     Document* m_document;
     106    WeakPtr<Document> m_document;
    107107    RefPtr<FontFaceSet> m_fontFaceSet;
    108108    Ref<CSSFontFaceSet> m_cssFontFaceSet;

  • trunk/Source/WebCore/css/MediaQueryMatcher.cpp

    r233838 r243459  
    3939
    4040MediaQueryMatcher::MediaQueryMatcher(Document& document)
    41     : m_document(&document)
     41    : m_document(makeWeakPtr(document))
    4242{
    4343}
    … …  
    8585
    8686    auto media = MediaQuerySet::create(query, MediaQueryParserContext(*m_document));
    87     reportMediaQueryWarningIfNeeded(m_document, media.ptr());
     87    reportMediaQueryWarningIfNeeded(m_document.get(), media.ptr());
    8888    bool result = evaluate(media.get());
    8989    return MediaQueryList::create(*this, WTFMove(media), result);

  • trunk/Source/WebCore/css/MediaQueryMatcher.h

    r205093 r243459  
    6767    String mediaType() const;
    6868
    69     Document* m_document;
     69    WeakPtr<Document> m_document;
    7070    Vector<Listener> m_listeners;
    7171

  • trunk/Source/WebCore/css/StyleSheetList.cpp

    r238758 r243459  
    3535
    3636StyleSheetList::StyleSheetList(Document& document)
    37     : m_document(&document)
     37    : m_document(makeWeakPtr(document))
    3838{
    3939}
    … …  
    5858{
    5959    if (m_document)
    60         return m_document;
     60        return m_document.get();
    6161    return m_shadowRoot;
    6262}

  • trunk/Source/WebCore/css/StyleSheetList.h

    r238758 r243459  
    2424#include <wtf/RefCounted.h>
    2525#include <wtf/Vector.h>
     26#include <wtf/WeakPtr.h>
    2627
    2728namespace WebCore {
    … …  
    5556    const Vector<RefPtr<StyleSheet>>& styleSheets() const;
    5657
    57     Document* m_document { nullptr };
     58    WeakPtr<Document> m_document;
    5859    ShadowRoot* m_shadowRoot { nullptr };
    5960    Vector<RefPtr<StyleSheet>> m_detachedStyleSheets;

  • trunk/Source/WebCore/css/ViewportStyleResolver.cpp

    r224320 r243459  
    4343
    4444ViewportStyleResolver::ViewportStyleResolver(Document* document)
    45     : m_document(document)
     45    : m_document(document ? makeWeakPtr(*document) : nullptr)
    4646{
    4747    ASSERT(m_document);

  • trunk/Source/WebCore/css/ViewportStyleResolver.h

    r218588 r243459  
    6262    float getViewportArgumentValue(CSSPropertyID) const;
    6363
    64     Document* m_document;
     64    WeakPtr<Document> m_document;
    6565    RefPtr<MutableStyleProperties> m_propertySet;
    6666};

  • trunk/Source/WebCore/dom/Document.h

    r243324 r243459  
    13451345    const Document* templateDocument() const;
    13461346    Document& ensureTemplateDocument();
    1347     void setTemplateDocumentHost(Document* templateDocumentHost) { m_templateDocumentHost = templateDocumentHost; }
    1348     Document* templateDocumentHost() { return m_templateDocumentHost; }
     1347    void setTemplateDocumentHost(Document* templateDocumentHost) { m_templateDocumentHost = makeWeakPtr(templateDocumentHost); }
     1348    Document* templateDocumentHost() { return m_templateDocumentHost.get(); }
    13491349
    13501350    void didAssociateFormControl(Element&);
    … …  
    19241924
    19251925    RefPtr<Document> m_templateDocument;
    1926     Document* m_templateDocumentHost { nullptr }; // Manually managed weakref (backpointer from m_templateDocument).
     1926    WeakPtr<Document> m_templateDocumentHost; // Manually managed weakref (backpointer from m_templateDocument).
    19271927
    19281928    Ref<CSSFontSelector> m_fontSelector;

  • trunk/Source/WebCore/dom/DocumentParser.cpp

    r191955 r243459  
    3434    : m_state(ParsingState)
    3535    , m_documentWasLoadedAsPartOfNavigation(false)
    36     , m_document(&document)
     36    , m_document(makeWeakPtr(document))
    3737{
    3838}

  • trunk/Source/WebCore/dom/DocumentParser.h

    r233891 r243459  
    6363
    6464    // document() will return 0 after detach() is called.
    65     Document* document() const { ASSERT(m_document); return m_document; }
     65    Document* document() const { ASSERT(m_document); return m_document.get(); }
    6666
    6767    bool isParsing() const { return m_state == ParsingState; }
    … …  
    115115    // Every DocumentParser needs a pointer back to the document.
    116116    // m_document will be 0 after the parser is stopped.
    117     Document* m_document;
     117    WeakPtr<Document> m_document;
    118118};
    119119

  • trunk/Source/WebCore/dom/ScriptedAnimationController.cpp

    r242714 r243459  
    5656
    5757ScriptedAnimationController::ScriptedAnimationController(Document& document)
    58     : m_document(&document)
     58    : m_document(makeWeakPtr(document))
    5959    , m_animationTimer(*this, &ScriptedAnimationController::animationTimerFired)
    6060{

  • trunk/Source/WebCore/dom/ScriptedAnimationController.h

    r242714 r243459  
    8585    CallbackList m_callbacks;
    8686
    87     Document* m_document;
     87    WeakPtr<Document> m_document;
    8888    CallbackId m_nextCallbackId { 0 };
    8989    int m_suspendCount { 0 };

  • trunk/Source/WebCore/html/parser/HTMLScriptRunner.cpp

    r234995 r243459  
    4848
    4949HTMLScriptRunner::HTMLScriptRunner(Document& document, HTMLScriptRunnerHost& host)
    50     : m_document(&document)
     50    : m_document(makeWeakPtr(document))
    5151    , m_host(host)
    5252    , m_scriptNestingLevel(0)
    … …  
    259259            m_parserBlockingScript = PendingScript::create(scriptElement, scriptStartPosition);
    260260        else
    261             scriptElement.executeClassicScript(ScriptSourceCode(scriptElement.element().textContent(), documentURLForScriptExecution(m_document), scriptStartPosition, JSC::SourceProviderSourceType::Program, InlineClassicScript::create(scriptElement)));
     261            scriptElement.executeClassicScript(ScriptSourceCode(scriptElement.element().textContent(), documentURLForScriptExecution(m_document.get()), scriptStartPosition, JSC::SourceProviderSourceType::Program, InlineClassicScript::create(scriptElement)));
    262262    } else
    263263        requestParsingBlockingScript(scriptElement);

  • trunk/Source/WebCore/html/parser/HTMLScriptRunner.h

    r210319 r243459  
    2929#include "PendingScript.h"
    3030#include <wtf/Deque.h>
     31#include <wtf/WeakPtr.h>
    3132#include <wtf/text/TextPosition.h>
    3233
    … …  
    7273    bool isPendingScriptReady(const PendingScript&);
    7374
    74     Document* m_document;
     75    WeakPtr<Document> m_document;
    7576    HTMLScriptRunnerHost& m_host;
    7677    RefPtr<PendingScript> m_parserBlockingScript;

  • trunk/Source/WebCore/loader/MediaResourceLoader.cpp

    r243163 r243459  
    4444MediaResourceLoader::MediaResourceLoader(Document& document, HTMLMediaElement& mediaElement, const String& crossOriginMode)
    4545    : ContextDestructionObserver(&document)
    46     , m_document(&document)
     46    , m_document(makeWeakPtr(document))
    4747    , m_mediaElement(makeWeakPtr(mediaElement))
    4848    , m_crossOriginMode(crossOriginMode)

  • trunk/Source/WebCore/loader/MediaResourceLoader.h

    r241444 r243459  
    5353    void removeResource(MediaResource&);
    5454
    55     Document* document() { return m_document; }
     55    Document* document() { return m_document.get(); }
    5656    const String& crossOriginMode() const { return m_crossOriginMode; }
    5757
    … …  
    6262    void contextDestroyed() override;
    6363
    64     Document* m_document;
     64    WeakPtr<Document> m_document;
    6565    WeakPtr<HTMLMediaElement> m_mediaElement;
    6666    String m_crossOriginMode;

  • trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp

    r243319 r243459  
    579579        return true;
    580580    case CachedResource::Type::CSSStyleSheet:
    581         document = m_document;
     581        document = m_document.get();
    582582        break;
    583583    default:
    … …  
    13041304{
    13051305    RefPtr<DocumentLoader> protectDocumentLoader(m_documentLoader);
    1306     RefPtr<Document> protectDocument(m_document);
     1306    RefPtr<Document> protectDocument(m_document.get());
    13071307
    13081308    ASSERT(shouldPerformPostLoadActions || type == LoadCompletionType::Cancel);

  • trunk/Source/WebCore/loader/cache/CachedResourceLoader.h

    r241121 r243459  
    126126   
    127127    Frame* frame() const; // Can be null
    128     Document* document() const { return m_document; } // Can be null
    129     void setDocument(Document* document) { m_document = document; }
     128    Document* document() const { return m_document.get(); } // Can be null
     129    void setDocument(Document* document) { m_document = makeWeakPtr(document); }
    130130    void clearDocumentLoader() { m_documentLoader = nullptr; }
    131131    PAL::SessionID sessionID() const;
    … …  
    194194    HashSet<String> m_validatedURLs;
    195195    mutable DocumentResourceMap m_documentResources;
    196     Document* m_document;
     196    WeakPtr<Document> m_document;
    197197    DocumentLoader* m_documentLoader;
    198198
Note: See TracChangeset for help on using the changeset viewer.