Changeset 239927 in webkit

Timestamp:

Jan 14, 2019 7:51:41 AM (5 years ago)

Author:

zandobersek@gmail.com

Message:

DOMCacheStorage: use-after-move in doSequentialMatch()
​https://bugs.webkit.org/show_bug.cgi?id=193396

Reviewed by Youenn Fablet.

Depending on the platform- and compiler-specific calling conventions,
the doSequentialMatch() code can move out the Vector<Ref<DOMCache>>
object into the callback lambda before the DOMCache object at the
specified index is retrieved for the DOMCache::doMatch() invocation.

This problem is now avoided by retrieving reference to the target
DOMCache object in an earlier expression.

• Modules/cache/DOMCacheStorage.cpp:

(WebCore::doSequentialMatch):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/cache/DOMCacheStorage.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-01-14  Zan Dobersek  <zdobersek@igalia.com>
+
+        DOMCacheStorage: use-after-move in doSequentialMatch()
+        https://bugs.webkit.org/show_bug.cgi?id=193396
+
+        Reviewed by Youenn Fablet.
+
+        Depending on the platform- and compiler-specific calling conventions,
+        the doSequentialMatch() code can move out the Vector<Ref<DOMCache>>
+        object into the callback lambda before the DOMCache object at the
+        specified index is retrieved for the DOMCache::doMatch() invocation.
+
+        This problem is now avoided by retrieving reference to the target
+        DOMCache object in an earlier expression.
+
+        * Modules/cache/DOMCacheStorage.cpp:
+        (WebCore::doSequentialMatch):
+
 2019-01-14  Zalan Bujtas  <zalan@apple.com>
 

trunk/Source/WebCore/Modules/cache/DOMCacheStorage.cpp

@@ -60 +60 @@
     }
 
-    caches[index]->doMatch(WTFMove(info), WTFMove(options), [caches = WTFMove(caches), info, options, completionHandler = WTFMove(completionHandler), index](ExceptionOr<FetchResponse*>&& result) mutable {
+    auto& cache = caches[index].get();
+    cache.doMatch(WTFMove(info), WTFMove(options), [caches = WTFMove(caches), info, options, completionHandler = WTFMove(completionHandler), index](ExceptionOr<FetchResponse*>&& result) mutable {
         if (result.hasException()) {
             completionHandler(result.releaseException());