Changeset 246660 in webkit

Timestamp:

Jun 20, 2019 3:52:06 PM (5 years ago)

Author:

beidson@apple.com

Message:

WebURLSchemeHandlerProxy::loadSynchronously crash with sync request.
<rdar://problem/51862206> and ​https://bugs.webkit.org/show_bug.cgi?id=199063

Reviewed by Geoffrey Garen.

Don't use a DataReference for the sync reply type.

• UIProcess/WebPageProxy.messages.in:
• UIProcess/WebURLSchemeHandler.h:

• UIProcess/WebURLSchemeTask.cpp:

(WebKit::WebURLSchemeTask::didComplete):

• UIProcess/WebURLSchemeTask.h:

• WebProcess/WebPage/WebURLSchemeHandlerProxy.cpp:

(WebKit::WebURLSchemeHandlerProxy::loadSynchronously):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/WebPageProxy.messages.in (modified) (1 diff)
• UIProcess/WebURLSchemeHandler.h (modified) (1 diff)
• UIProcess/WebURLSchemeTask.cpp (modified) (1 diff)
• UIProcess/WebURLSchemeTask.h (modified) (1 diff)
• WebProcess/WebPage/WebURLSchemeHandlerProxy.cpp (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-06-20  Brady Eidson  <beidson@apple.com>
+
+        WebURLSchemeHandlerProxy::loadSynchronously crash with sync request.
+        <rdar://problem/51862206> and https://bugs.webkit.org/show_bug.cgi?id=199063
+
+        Reviewed by Geoffrey Garen.
+
+        Don't use a DataReference for the sync reply type.
+
+        * UIProcess/WebPageProxy.messages.in:
+        * UIProcess/WebURLSchemeHandler.h:
+
+        * UIProcess/WebURLSchemeTask.cpp:
+        (WebKit::WebURLSchemeTask::didComplete):
+        * UIProcess/WebURLSchemeTask.h:
+
+        * WebProcess/WebPage/WebURLSchemeHandlerProxy.cpp:
+        (WebKit::WebURLSchemeHandlerProxy::loadSynchronously):
+
 2019-06-20  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebKit/UIProcess/WebPageProxy.messages.in

@@ -537 +537 @@
     StartURLSchemeTask(struct WebKit::URLSchemeTaskParameters parameters)
     StopURLSchemeTask(uint64_t handlerIdentifier, uint64_t taskIdentifier)
-    LoadSynchronousURLSchemeTask(struct WebKit::URLSchemeTaskParameters parameters) -> (WebCore::ResourceResponse response, WebCore::ResourceError error, IPC::DataReference data) Synchronous
+    LoadSynchronousURLSchemeTask(struct WebKit::URLSchemeTaskParameters parameters) -> (WebCore::ResourceResponse response, WebCore::ResourceError error, Vector<char> data) Synchronous
 
 #if ENABLE(DEVICE_ORIENTATION)

trunk/Source/WebKit/UIProcess/WebURLSchemeHandler.h

@@ -45 +45 @@
 class WebProcessProxy;
 
-using SyncLoadCompletionHandler = CompletionHandler<void(const WebCore::ResourceResponse&, const WebCore::ResourceError&, const IPC::DataReference&)>;
+using SyncLoadCompletionHandler = CompletionHandler<void(const WebCore::ResourceResponse&, const WebCore::ResourceError&, const Vector<char>&)>;
 
 class WebURLSchemeHandler : public RefCounted<WebURLSchemeHandler> {

trunk/Source/WebKit/UIProcess/WebURLSchemeTask.cpp

@@ -137 +137 @@
     
     if (isSync()) {
-        IPC::DataReference data;
-        if (m_syncData)
-            data = { reinterpret_cast<const uint8_t*>(m_syncData->data()), m_syncData->size() };
-        m_syncCompletionHandler(m_syncResponse, error, data);
+        Vector<char> data;
+        if (m_syncData) {
+            data.resize(m_syncData->size());
+            memcpy(data.data(), reinterpret_cast<const char*>(m_syncData->data()), m_syncData->size());
+        }
+
+        m_syncCompletionHandler(m_syncResponse, error, WTFMove(data));
         m_syncData = nullptr;
     }

trunk/Source/WebKit/UIProcess/WebURLSchemeTask.h

@@ -50 +50 @@
 class WebPageProxy;
 
-using SyncLoadCompletionHandler = CompletionHandler<void(const WebCore::ResourceResponse&, const WebCore::ResourceError&, const IPC::DataReference&)>;
+using SyncLoadCompletionHandler = CompletionHandler<void(const WebCore::ResourceResponse&, const WebCore::ResourceError&, const Vector<char>&)>;
 
 class WebURLSchemeTask : public RefCounted<WebURLSchemeTask>, public InstanceCounted<WebURLSchemeTask> {

trunk/Source/WebKit/WebProcess/WebPage/WebURLSchemeHandlerProxy.cpp

@@ -65 +65 @@
 void WebURLSchemeHandlerProxy::loadSynchronously(ResourceLoadIdentifier loadIdentifier, const ResourceRequest& request, ResourceResponse& response, ResourceError& error, Vector<char>& data)
 {
-    IPC::DataReference dataReference;
-    if (!m_webPage.sendSync(Messages::WebPageProxy::LoadSynchronousURLSchemeTask(URLSchemeTaskParameters { m_identifier, loadIdentifier, request }), Messages::WebPageProxy::LoadSynchronousURLSchemeTask::Reply(response, error, dataReference))) {
+    data.shrink(0);
+    if (!m_webPage.sendSync(Messages::WebPageProxy::LoadSynchronousURLSchemeTask(URLSchemeTaskParameters { m_identifier, loadIdentifier, request }), Messages::WebPageProxy::LoadSynchronousURLSchemeTask::Reply(response, error, data))) {
         error = failedCustomProtocolSyncLoad(request);
         return;
     }
-    
-    data.resize(dataReference.size());
-    memcpy(data.data(), dataReference.data(), dataReference.size());
 }