Changeset 140886 in webkit

Timestamp:

Jan 25, 2013, 5:26:08 PM (13 years ago)

Author:

haraken@chromium.org

Message:

Keep a RefPtr<SerializedScriptValue*> when we call serialize()/deserialize() in PopStateEvent
​https://bugs.webkit.org/show_bug.cgi?id=107904

Reviewed by Abhishek Arya.

If you use a raw SerializedScriptValue* for serialize()/deserialize(),
it can potentially cause a use-after-free. This is because serialize()/
deserialize() can destruct a RefPtr of the SerializedScriptValue*,
depending on data that is serialized/deserialized. So we should keep a
RefPtr<SerializedScriptValue*> when we call serialize()/deserialize().
(See ​https://bugs.webkit.org/show_bug.cgi?id=107792 for more details.)

No tests. This is just a just-in-case fix.

• dom/PopStateEvent.h:

(WebCore::PopStateEvent::serializedState):

• page/History.cpp:

(WebCore::History::isSameAsCurrentState):

• page/History.h:

(History):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• dom/PopStateEvent.h (modified) (1 diff)
• page/History.cpp (modified) (1 diff)
• page/History.h (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-01-25  Kentaro Hara  <haraken@chromium.org>
+
+        Keep a RefPtr<SerializedScriptValue*> when we call serialize()/deserialize() in PopStateEvent
+        https://bugs.webkit.org/show_bug.cgi?id=107904
+
+        Reviewed by Abhishek Arya.
+
+        If you use a raw SerializedScriptValue* for serialize()/deserialize(),
+        it can potentially cause a use-after-free. This is because serialize()/
+        deserialize() can destruct a RefPtr of the SerializedScriptValue*,
+        depending on data that is serialized/deserialized. So we should keep a
+        RefPtr<SerializedScriptValue*> when we call serialize()/deserialize().
+        (See https://bugs.webkit.org/show_bug.cgi?id=107792 for more details.)
+
+        No tests. This is just a just-in-case fix.
+
+        * dom/PopStateEvent.h:
+        (WebCore::PopStateEvent::serializedState):
+        * page/History.cpp:
+        (WebCore::History::isSameAsCurrentState):
+        * page/History.h:
+        (History):
+
 2013-01-25  Kentaro Hara  <haraken@chromium.org>
 

trunk/Source/WebCore/dom/PopStateEvent.h

@@ -49 +49 @@
     static PassRefPtr<PopStateEvent> create(const AtomicString&, const PopStateEventInit&);
 
-    SerializedScriptValue* serializedState() const { return m_serializedState.get(); }
+    PassRefPtr<SerializedScriptValue> serializedState() const { return m_serializedState; }
     const ScriptValue& state() const { return m_state; }
     History* history() const { return m_history.get(); }

trunk/Source/WebCore/page/History.cpp

@@ -78 +78 @@
 }
 
-bool History::isSameAsCurrentState(SerializedScriptValue* state) const
+bool History::isSameAsCurrentState(PassRefPtr<SerializedScriptValue> state) const
 {
     return state == stateInternal();

trunk/Source/WebCore/page/History.h

@@ -56 +56 @@
 
     bool stateChanged() const;
-    bool isSameAsCurrentState(SerializedScriptValue*) const;
+    bool isSameAsCurrentState(PassRefPtr<SerializedScriptValue>) const;
 
     enum StateObjectType {