Changeset 246526 in webkit

Timestamp:

Jun 17, 2019 5:17:24 PM (5 years ago)

Author:

achristensen@apple.com

Message:

Protect StorageManager::m_localStorageNamespaces with a Lock
​https://bugs.webkit.org/show_bug.cgi?id=198939
<rdar://problem/51784225>

Reviewed by Geoff Garen.

StorageManager::LocalStorageNamespace::didDestroyStorageArea is called from StorageArea::~StorageArea which is called on the main thread.
All other access of m_localStorageNamespaces is from the non-main thread. Sometimes this causes hash table corruption, so wait for a mutex
before accessing this member variable.

• NetworkProcess/WebStorage/StorageManager.cpp:

(WebKit::StorageManager::LocalStorageNamespace::didDestroyStorageArea):
(WebKit::StorageManager::cloneSessionStorageNamespace):
(WebKit::StorageManager::getLocalStorageOrigins):
(WebKit::StorageManager::deleteLocalStorageEntriesForOrigin):
(WebKit::StorageManager::deleteLocalStorageOriginsModifiedSince):
(WebKit::StorageManager::deleteLocalStorageEntriesForOrigins):
(WebKit::StorageManager::getOrCreateLocalStorageNamespace):

• NetworkProcess/WebStorage/StorageManager.h:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• NetworkProcess/WebStorage/StorageManager.cpp (modified) (7 diffs)
• NetworkProcess/WebStorage/StorageManager.h (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-06-17  Alex Christensen  <achristensen@webkit.org>
+
+        Protect StorageManager::m_localStorageNamespaces with a Lock
+        https://bugs.webkit.org/show_bug.cgi?id=198939
+        <rdar://problem/51784225>
+
+        Reviewed by Geoff Garen.
+
+        StorageManager::LocalStorageNamespace::didDestroyStorageArea is called from StorageArea::~StorageArea which is called on the main thread.
+        All other access of m_localStorageNamespaces is from the non-main thread.  Sometimes this causes hash table corruption, so wait for a mutex
+        before accessing this member variable.
+
+        * NetworkProcess/WebStorage/StorageManager.cpp:
+        (WebKit::StorageManager::LocalStorageNamespace::didDestroyStorageArea):
+        (WebKit::StorageManager::cloneSessionStorageNamespace):
+        (WebKit::StorageManager::getLocalStorageOrigins):
+        (WebKit::StorageManager::deleteLocalStorageEntriesForOrigin):
+        (WebKit::StorageManager::deleteLocalStorageOriginsModifiedSince):
+        (WebKit::StorageManager::deleteLocalStorageEntriesForOrigins):
+        (WebKit::StorageManager::getOrCreateLocalStorageNamespace):
+        * NetworkProcess/WebStorage/StorageManager.h:
+
 2019-06-17  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebKit/NetworkProcess/WebStorage/StorageManager.cpp

@@ -377 +377 @@
         return;
 
+    std::lock_guard<Lock> lock(m_storageManager.m_localStorageNamespacesMutex);
     ASSERT(m_storageManager.m_localStorageNamespaces.contains(m_storageNamespaceID));
     m_storageManager.m_localStorageNamespaces.remove(m_storageNamespaceID);
@@ -573 +574 @@
 
         if (!m_localStorageDatabaseTracker) {
+            std::lock_guard<Lock> lock(m_localStorageNamespacesMutex);
             if (auto* localStorageNamespace = m_localStorageNamespaces.get(storageNamespaceID)) {
                 LocalStorageNamespace* newlocalStorageNamespace = getOrCreateLocalStorageNamespace(newStorageNamespaceID);
@@ -663 +665 @@
                 origins.add(origin);
         } else {
+            std::lock_guard<Lock> lock(m_localStorageNamespacesMutex);
             for (const auto& localStorageNameSpace : m_localStorageNamespaces.values()) {
                 for (auto& origin : localStorageNameSpace->ephemeralOrigins())
@@ -696 +699 @@
 {
     m_queue->dispatch([this, protectedThis = makeRef(*this), copiedOrigin = securityOrigin.isolatedCopy()]() mutable {
-        for (auto& localStorageNamespace : m_localStorageNamespaces.values())
-            localStorageNamespace->clearStorageAreasMatchingOrigin(copiedOrigin);
+        {
+            std::lock_guard<Lock> lock(m_localStorageNamespacesMutex);
+            for (auto& localStorageNamespace : m_localStorageNamespaces.values())
+                localStorageNamespace->clearStorageAreasMatchingOrigin(copiedOrigin);
+        }
 
         for (auto& transientLocalStorageNamespace : m_transientLocalStorageNamespaces.values())
@@ -717 +723 @@
 
             for (const auto& origin : originsToDelete) {
-                for (auto& localStorageNamespace : m_localStorageNamespaces.values())
-                    localStorageNamespace->clearStorageAreasMatchingOrigin(origin);
+                {
+                    std::lock_guard<Lock> lock(m_localStorageNamespacesMutex);
+                    for (auto& localStorageNamespace : m_localStorageNamespaces.values())
+                        localStorageNamespace->clearStorageAreasMatchingOrigin(origin);
+                }
                 
                 m_localStorageDatabaseTracker->deleteDatabaseWithOrigin(origin);
             }
         } else {
+            std::lock_guard<Lock> lock(m_localStorageNamespacesMutex);
             for (auto& localStorageNamespace : m_localStorageNamespaces.values())
                 localStorageNamespace->clearAllStorageAreas();
@@ -741 +751 @@
     m_queue->dispatch([this, protectedThis = makeRef(*this), copiedOrigins = WTFMove(copiedOrigins), completionHandler = WTFMove(completionHandler)]() mutable {
         for (auto& origin : copiedOrigins) {
-            for (auto& localStorageNamespace : m_localStorageNamespaces.values())
-                localStorageNamespace->clearStorageAreasMatchingOrigin(origin);
+            {
+                std::lock_guard<Lock> lock(m_localStorageNamespacesMutex);
+                for (auto& localStorageNamespace : m_localStorageNamespaces.values())
+                    localStorageNamespace->clearStorageAreasMatchingOrigin(origin);
+            }
 
             for (auto& transientLocalStorageNamespace : m_transientLocalStorageNamespaces.values())
@@ -1000 +1013 @@
 StorageManager::LocalStorageNamespace* StorageManager::getOrCreateLocalStorageNamespace(uint64_t storageNamespaceID)
 {
+    std::lock_guard<Lock> lock(m_localStorageNamespacesMutex);
     if (!m_localStorageNamespaces.isValidKey(storageNamespaceID))
         return nullptr;

trunk/Source/WebKit/NetworkProcess/WebStorage/StorageManager.h

@@ -106 +106 @@
     RefPtr<LocalStorageDatabaseTracker> m_localStorageDatabaseTracker;
     HashMap<uint64_t, RefPtr<LocalStorageNamespace>> m_localStorageNamespaces;
+    Lock m_localStorageNamespacesMutex;
 
     HashMap<std::pair<uint64_t, WebCore::SecurityOriginData>, RefPtr<TransientLocalStorageNamespace>> m_transientLocalStorageNamespaces;