Changeset 195166 in webkit

Timestamp:

Jan 16, 2016 1:36:44 AM (8 years ago)

Author:

Carlos Garcia Campos

Message:

[GTK] GVariant runtime critical errors when encoding session data
​https://bugs.webkit.org/show_bug.cgi?id=153130

Reviewed by Michael Catanzaro.

It happens when the FrameState has children, because the recursive
serialization is wrong. Also fix serialization of
documentSequenceNumber and itemSequenceNumber that are gint64, not
guint64.

• UIProcess/API/gtk/WebKitWebViewSessionState.cpp:

(encodeFrameState): Let the caller open/init the given
builder. Use a new builder to encode child states recursively.
(encodePageState): Do the builder open/close for the FrameState encoding.
(decodeFrameState): Get the variant of every child.

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/API/gtk/WebKitWebViewSessionState.cpp (modified) (7 diffs)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2016-01-16  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] GVariant runtime critical errors when encoding session data
+        https://bugs.webkit.org/show_bug.cgi?id=153130
+
+        Reviewed by Michael Catanzaro.
+
+        It happens when the FrameState has children, because the recursive
+        serialization is wrong. Also fix serialization of
+        documentSequenceNumber and itemSequenceNumber that are gint64, not
+        guint64.
+
+        * UIProcess/API/gtk/WebKitWebViewSessionState.cpp:
+        (encodeFrameState): Let the caller open/init the given
+        builder. Use a new builder to encode child states recursively.
+        (encodePageState): Do the builder open/close for the FrameState encoding.
+        (decodeFrameState): Get the variant of every child.
+
 2016-01-15  Michael Catanzaro  <mcatanzaro@igalia.com>
 

trunk/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewSessionState.cpp

@@ -45 +45 @@
 #define HTTP_BODY_TYPE_STRING_V1 "m(sa" HTTP_BODY_ELEMENT_TYPE_STRING_V1 ")"
 #define HTTP_BODY_FORMAT_STRING_V1 "m(&sa" HTTP_BODY_ELEMENT_TYPE_STRING_V1 ")"
-#define FRAME_STATE_TYPE_STRING_V1  "(ssssasmaytt(ii)d" HTTP_BODY_TYPE_STRING_V1 "av)"
-#define FRAME_STATE_FORMAT_STRING_V1  "(&s&s&s&sasmaytt(ii)d@" HTTP_BODY_TYPE_STRING_V1 "av)"
+#define FRAME_STATE_TYPE_STRING_V1  "(ssssasmayxx(ii)d" HTTP_BODY_TYPE_STRING_V1 "av)"
+#define FRAME_STATE_FORMAT_STRING_V1  "(&s&s&s&sasmayxx(ii)d@" HTTP_BODY_TYPE_STRING_V1 "av)"
 #define BACK_FORWARD_LIST_ITEM_TYPE_STRING_V1  "(ts" FRAME_STATE_TYPE_STRING_V1 "u)"
 #define BACK_FORWARD_LIST_ITEM_FORMAT_STRING_V1  "(t&s@" FRAME_STATE_TYPE_STRING_V1 "u)"
@@ -151 +151 @@
 static inline void encodeFrameState(GVariantBuilder* sessionBuilder, const FrameState& frameState)
 {
-    g_variant_builder_open(sessionBuilder, G_VARIANT_TYPE(FRAME_STATE_TYPE_STRING_V1));
     g_variant_builder_add(sessionBuilder, "s", frameState.urlString.utf8().data());
     g_variant_builder_add(sessionBuilder, "s", frameState.originalURLString.utf8().data());
@@ -170 +169 @@
         g_variant_builder_close(sessionBuilder);
     }
-    g_variant_builder_add(sessionBuilder, "t", frameState.documentSequenceNumber);
-    g_variant_builder_add(sessionBuilder, "t", frameState.itemSequenceNumber);
+    g_variant_builder_add(sessionBuilder, "x", frameState.documentSequenceNumber);
+    g_variant_builder_add(sessionBuilder, "x", frameState.itemSequenceNumber);
     g_variant_builder_add(sessionBuilder, "(ii)", frameState.scrollPosition.x(), frameState.scrollPosition.y());
     g_variant_builder_add(sessionBuilder, "d", frameState.pageScaleFactor);
@@ -182 +181 @@
     }
     g_variant_builder_open(sessionBuilder, G_VARIANT_TYPE("av"));
-    for (const auto& child : frameState.children)
-        encodeFrameState(sessionBuilder, child);
-    g_variant_builder_close(sessionBuilder);
+    for (const auto& child : frameState.children) {
+        GVariantBuilder frameStateBuilder;
+        g_variant_builder_init(&frameStateBuilder, G_VARIANT_TYPE(FRAME_STATE_TYPE_STRING_V1));
+        encodeFrameState(&frameStateBuilder, child);
+        g_variant_builder_add(sessionBuilder, "v", g_variant_builder_end(&frameStateBuilder));
+    }
     g_variant_builder_close(sessionBuilder);
 }
@@ -191 +193 @@
 {
     g_variant_builder_add(sessionBuilder, "s", pageState.title.utf8().data());
+    g_variant_builder_open(sessionBuilder, G_VARIANT_TYPE(FRAME_STATE_TYPE_STRING_V1));
     encodeFrameState(sessionBuilder, pageState.mainFrameState);
+    g_variant_builder_close(sessionBuilder);
     g_variant_builder_add(sessionBuilder, "u", toExternalURLsPolicy(pageState.shouldOpenExternalURLsPolicy));
 }
@@ -279 +283 @@
     GUniqueOutPtr<GVariantIter> documentStateIter;
     GUniqueOutPtr<GVariantIter> stateObjectDataIter;
-    guint64 documentSequenceNumber;
-    guint64 itemSequenceNumber;
+    gint64 documentSequenceNumber;
+    gint64 itemSequenceNumber;
     gint32 scrollPositionX, scrollPositionY;
     gdouble pageScaleFactor;
@@ -319 +323 @@
     while (GRefPtr<GVariant> child = adoptGRef(g_variant_iter_next_value(childrenIter.get()))) {
         FrameState childFrameState;
-        decodeFrameState(child.get(), childFrameState);
+        GRefPtr<GVariant> childVariant = adoptGRef(g_variant_get_variant(child.get()));
+        decodeFrameState(childVariant.get(), childFrameState);
         frameState.children.append(WTFMove(childFrameState));
     }