Changeset 227789 in webkit


Ignore:
Timestamp:
Jan 30, 2018 9:21:49 AM (6 years ago)
Author:
Chris Dumez
Message:

Make sure we never create a WebSWClientConnection with an invalid sessionID
​https://bugs.webkit.org/show_bug.cgi?id=182276
<rdar://problem/36582633>

Reviewed by Alex Christensen.

Make sure we never create a WebSWClientConnection with an invalid sessionID as this
could corrupt our hash tables.

Source/WebCore:

  • dom/Document.cpp:

(WebCore::Document::privateBrowsingStateDidChange):

  • workers/service/ServiceWorker.cpp:

(WebCore::ServiceWorker::postMessage):

  • workers/service/ServiceWorkerContainer.cpp:

(WebCore::ServiceWorkerContainer::ready):
(WebCore::ServiceWorkerContainer::getRegistration):
(WebCore::ServiceWorkerContainer::didFinishGetRegistrationRequest):
(WebCore::ServiceWorkerContainer::getRegistrations):
(WebCore::ServiceWorkerContainer::didFinishGetRegistrationsRequest):
(WebCore::ServiceWorkerContainer::jobResolvedWithRegistration):
(WebCore::ServiceWorkerContainer::ensureSWClientConnection):

Source/WebKit:

  • StorageProcess/StorageProcess.cpp:

(WebKit::StorageProcess::swServerForSession):

  • UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::establishWorkerContextConnectionToStorageProcess):

  • WebProcess/Storage/WebSWClientConnection.cpp:

(WebKit::WebSWClientConnection::WebSWClientConnection):

  • WebProcess/Storage/WebServiceWorkerProvider.cpp:

(WebKit::WebServiceWorkerProvider::serviceWorkerConnectionForSession):
(WebKit::WebServiceWorkerProvider::existingServiceWorkerConnectionForSession):

  • WebProcess/Storage/WebToStorageProcessConnection.cpp:

(WebKit::WebToStorageProcessConnection::serviceWorkerConnectionForSession):

Location:
trunk/Source
Files:
10 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebCore/ChangeLog

    r227787 r227789  
     12018-01-30  Chris Dumez  <cdumez@apple.com>
     2
     3        Make sure we never create a WebSWClientConnection with an invalid sessionID
     4        https://bugs.webkit.org/show_bug.cgi?id=182276
     5        <rdar://problem/36582633>
     6
     7        Reviewed by Alex Christensen.
     8
     9        Make sure we never create a WebSWClientConnection with an invalid sessionID as this
     10        could corrupt our hash tables.
     11
     12        * dom/Document.cpp:
     13        (WebCore::Document::privateBrowsingStateDidChange):
     14        * workers/service/ServiceWorker.cpp:
     15        (WebCore::ServiceWorker::postMessage):
     16        * workers/service/ServiceWorkerContainer.cpp:
     17        (WebCore::ServiceWorkerContainer::ready):
     18        (WebCore::ServiceWorkerContainer::getRegistration):
     19        (WebCore::ServiceWorkerContainer::didFinishGetRegistrationRequest):
     20        (WebCore::ServiceWorkerContainer::getRegistrations):
     21        (WebCore::ServiceWorkerContainer::didFinishGetRegistrationsRequest):
     22        (WebCore::ServiceWorkerContainer::jobResolvedWithRegistration):
     23        (WebCore::ServiceWorkerContainer::ensureSWClientConnection):
     24
    1252018-01-30  Antti Koivisto  <antti@apple.com>
    226

  • trunk/Source/WebCore/dom/Document.cpp

    r227242 r227789  
    49974997
    49984998#if ENABLE(SERVICE_WORKER)
    4999     if (RuntimeEnabledFeatures::sharedFeatures().serviceWorkerEnabled() && m_serviceWorkerConnection)
     4999    ASSERT(sessionID().isValid());
     5000    if (RuntimeEnabledFeatures::sharedFeatures().serviceWorkerEnabled() && m_serviceWorkerConnection && sessionID().isValid())
    50005001        setServiceWorkerConnection(&ServiceWorkerProvider::singleton().serviceWorkerConnectionForSession(sessionID()));
    50015002#endif

  • trunk/Source/WebCore/workers/service/ServiceWorker.cpp

    r227425 r227789  
    9696ExceptionOr<void> ServiceWorker::postMessage(ScriptExecutionContext& context, JSC::JSValue messageValue, Vector<JSC::Strong<JSC::JSObject>>&& transfer)
    9797{
    98     if (m_isStopped)
     98    if (m_isStopped || !context.sessionID().isValid())
    9999        return Exception { InvalidStateError };
    100100

  • trunk/Source/WebCore/workers/service/ServiceWorkerContainer.cpp

    r227350 r227789  
    8787        m_readyPromise = std::make_unique<ReadyPromise>();
    8888
    89         auto* context = scriptExecutionContext();
    90         if (!context)
     89        if (m_isStopped || !scriptExecutionContext()->sessionID().isValid())
    9190            return *m_readyPromise;
    9291
     92        auto& context = *scriptExecutionContext();
    9393        auto contextIdentifier = this->contextIdentifier();
    94         callOnMainThread([this, connection = makeRef(ensureSWClientConnection()), topOrigin = context->topOrigin().isolatedCopy(), clientURL = context->url().isolatedCopy(), contextIdentifier]() mutable {
     94        callOnMainThread([this, connection = makeRef(ensureSWClientConnection()), topOrigin = context.topOrigin().isolatedCopy(), clientURL = context.url().isolatedCopy(), contextIdentifier]() mutable {
    9595            connection->whenRegistrationReady(topOrigin, clientURL, [this, contextIdentifier](auto&& registrationData) {
    9696                ScriptExecutionContext::postTaskTo(contextIdentifier, [this, registrationData = crossThreadCopy(registrationData)](auto&) mutable {
    97                     if (m_isStopped)
     97                    if (m_isStopped || !scriptExecutionContext()->sessionID().isValid())
    9898                        return;
    9999
    … …  
    250250void ServiceWorkerContainer::getRegistration(const String& clientURL, Ref<DeferredPromise>&& promise)
    251251{
    252     if (m_isStopped) {
     252    auto* context = scriptExecutionContext();
     253    if (m_isStopped || !context->sessionID().isValid()) {
    253254        promise->reject(Exception { InvalidStateError });
    254255        return;
    255256    }
    256257
    257     ASSERT(scriptExecutionContext());
    258     auto& context = *scriptExecutionContext();
    259 
    260     URL parsedURL = context.completeURL(clientURL);
    261     if (!protocolHostAndPortAreEqual(parsedURL, context.url())) {
     258    URL parsedURL = context->completeURL(clientURL);
     259    if (!protocolHostAndPortAreEqual(parsedURL, context->url())) {
    262260        promise->reject(Exception { SecurityError, ASCIILiteral("Origin of clientURL is not client's origin") });
    263261        return;
    … …  
    269267
    270268    auto contextIdentifier = this->contextIdentifier();
    271     callOnMainThread([connection = makeRef(ensureSWClientConnection()), this, topOrigin = context.topOrigin().isolatedCopy(), parsedURL = parsedURL.isolatedCopy(), contextIdentifier, pendingPromiseIdentifier]() mutable {
     269    callOnMainThread([connection = makeRef(ensureSWClientConnection()), this, topOrigin = context->topOrigin().isolatedCopy(), parsedURL = parsedURL.isolatedCopy(), contextIdentifier, pendingPromiseIdentifier]() mutable {
    272270        connection->matchRegistration(topOrigin, parsedURL, [this, contextIdentifier, pendingPromiseIdentifier] (auto&& result) mutable {
    273271            ScriptExecutionContext::postTaskTo(contextIdentifier, [this, pendingPromiseIdentifier, result = crossThreadCopy(result)](ScriptExecutionContext&) mutable {
    … …  
    288286        return;
    289287
    290     ASSERT(!m_isStopped);
     288    if (m_isStopped || !scriptExecutionContext()->sessionID().isValid()) {
     289        pendingPromise->promise->reject(Exception { InvalidStateError });
     290        return;
     291    }
    291292
    292293    if (!result) {
    … …  
    317318void ServiceWorkerContainer::getRegistrations(Ref<DeferredPromise>&& promise)
    318319{
    319     if (m_isStopped) {
     320    auto* context = scriptExecutionContext();
     321    if (m_isStopped || !context->sessionID().isValid()) {
    320322        promise->reject(Exception { InvalidStateError });
    321323        return;
    322324    }
    323 
    324     ASSERT(scriptExecutionContext());
    325     auto& context = *scriptExecutionContext();
    326325
    327326    uint64_t pendingPromiseIdentifier = ++m_lastPendingPromiseIdentifier;
    … …  
    330329
    331330    auto contextIdentifier = this->contextIdentifier();
    332     auto contextURL = context.url();
    333     callOnMainThread([connection = makeRef(ensureSWClientConnection()), this, topOrigin = context.topOrigin().isolatedCopy(), contextURL = contextURL.isolatedCopy(), contextIdentifier, pendingPromiseIdentifier]() mutable {
     331    auto contextURL = context->url();
     332    callOnMainThread([connection = makeRef(ensureSWClientConnection()), this, topOrigin = context->topOrigin().isolatedCopy(), contextURL = contextURL.isolatedCopy(), contextIdentifier, pendingPromiseIdentifier]() mutable {
    334333        connection->getRegistrations(topOrigin, contextURL, [this, contextIdentifier, pendingPromiseIdentifier] (auto&& registrationDatas) mutable {
    335334            ScriptExecutionContext::postTaskTo(contextIdentifier, [this, pendingPromiseIdentifier, registrationDatas = crossThreadCopy(registrationDatas)](ScriptExecutionContext&) mutable {
    … …  
    350349        return;
    351350
    352     ASSERT(!m_isStopped);
     351    if (m_isStopped || !scriptExecutionContext()->sessionID().isValid()) {
     352        pendingPromise->promise->reject(Exception { InvalidStateError });
     353        return;
     354    }
    353355
    354356    auto registrations = WTF::map(WTFMove(registrationDatas), [&] (auto&& registrationData) {
    … …  
    435437
    436438    scriptExecutionContext()->postTask([this, protectedThis = makeRef(*this), job = makeRef(job), data = WTFMove(data), notifyWhenResolvedIfNeeded = WTFMove(notifyWhenResolvedIfNeeded)](ScriptExecutionContext& context) mutable {
    437         if (isStopped()) {
     439        if (isStopped() || !context.sessionID().isValid()) {
    438440            notifyWhenResolvedIfNeeded();
    439441            return;
    … …  
    556558SWClientConnection& ServiceWorkerContainer::ensureSWClientConnection()
    557559{
     560    ASSERT(scriptExecutionContext());
     561    ASSERT(scriptExecutionContext()->sessionID().isValid());
    558562    if (!m_swConnection) {
    559563        ASSERT(scriptExecutionContext());

  • trunk/Source/WebKit/ChangeLog

    r227778 r227789  
     12018-01-30  Chris Dumez  <cdumez@apple.com>
     2
     3        Make sure we never create a WebSWClientConnection with an invalid sessionID
     4        https://bugs.webkit.org/show_bug.cgi?id=182276
     5        <rdar://problem/36582633>
     6
     7        Reviewed by Alex Christensen.
     8
     9        Make sure we never create a WebSWClientConnection with an invalid sessionID as this
     10        could corrupt our hash tables.
     11
     12        * StorageProcess/StorageProcess.cpp:
     13        (WebKit::StorageProcess::swServerForSession):
     14        * UIProcess/WebProcessPool.cpp:
     15        (WebKit::WebProcessPool::establishWorkerContextConnectionToStorageProcess):
     16        * WebProcess/Storage/WebSWClientConnection.cpp:
     17        (WebKit::WebSWClientConnection::WebSWClientConnection):
     18        * WebProcess/Storage/WebServiceWorkerProvider.cpp:
     19        (WebKit::WebServiceWorkerProvider::serviceWorkerConnectionForSession):
     20        (WebKit::WebServiceWorkerProvider::existingServiceWorkerConnectionForSession):
     21        * WebProcess/Storage/WebToStorageProcessConnection.cpp:
     22        (WebKit::WebToStorageProcessConnection::serviceWorkerConnectionForSession):
     23
    1242018-01-30  Basuke Suzuki  <Basuke.Suzuki@sony.com>
    225

  • trunk/Source/WebKit/StorageProcess/StorageProcess.cpp

    r227425 r227789  
    405405SWServer& StorageProcess::swServerForSession(PAL::SessionID sessionID)
    406406{
     407    ASSERT(sessionID.isValid());
    407408    auto result = m_swServers.add(sessionID, nullptr);
    408409    if (!result.isNewEntry) {

  • trunk/Source/WebKit/UIProcess/WebProcessPool.cpp

    r227687 r227789  
    613613    auto serviceWorkerProcessProxy = ServiceWorkerProcessProxy::create(*this, *websiteDataStore);
    614614    m_serviceWorkerProcess = serviceWorkerProcessProxy.ptr();
    615     sendToAllProcesses(Messages::WebProcess::RegisterServiceWorkerClients { websiteDataStore->sessionID() });
     615    ASSERT(websiteDataStore->sessionID().isValid());
     616    if (websiteDataStore->sessionID().isValid())
     617        sendToAllProcesses(Messages::WebProcess::RegisterServiceWorkerClients { websiteDataStore->sessionID() });
    616618
    617619    updateProcessAssertions();

  • trunk/Source/WebKit/WebProcess/Storage/WebSWClientConnection.cpp

    r227751 r227789  
    5454    , m_swOriginTable(makeUniqueRef<WebSWOriginTable>())
    5555{
     56    ASSERT(sessionID.isValid());
    5657    bool result = sendSync(Messages::StorageToWebProcessConnection::EstablishSWServerConnection(sessionID), Messages::StorageToWebProcessConnection::EstablishSWServerConnection::Reply(m_identifier), Seconds::infinity(), IPC::SendSyncOption::DoNotProcessIncomingMessagesWhenWaitingForSyncReply);
    5758

  • trunk/Source/WebKit/WebProcess/Storage/WebServiceWorkerProvider.cpp

    r227709 r227789  
    5757WebCore::SWClientConnection& WebServiceWorkerProvider::serviceWorkerConnectionForSession(SessionID sessionID)
    5858{
     59    ASSERT(sessionID.isValid());
    5960    return WebProcess::singleton().ensureWebToStorageProcessConnection(sessionID).serviceWorkerConnectionForSession(sessionID);
    6061}
    … …  
    6263WebCore::SWClientConnection* WebServiceWorkerProvider::existingServiceWorkerConnectionForSession(SessionID sessionID)
    6364{
     65    ASSERT(sessionID.isValid());
    6466    auto* webToStorageProcessConnection = WebProcess::singleton().existingWebToStorageProcessConnection();
    6567    if (!webToStorageProcessConnection)

  • trunk/Source/WebKit/WebProcess/Storage/WebToStorageProcessConnection.cpp

    r227452 r227789  
    141141WebSWClientConnection& WebToStorageProcessConnection::serviceWorkerConnectionForSession(SessionID sessionID)
    142142{
     143    ASSERT(sessionID.isValid());
    143144    return *m_swConnectionsBySession.ensure(sessionID, [&] {
    144145        auto connection = WebSWClientConnection::create(m_connection, sessionID);
Note: See TracChangeset for help on using the changeset viewer.