Changeset 258530 in webkit

Timestamp:

Mar 16, 2020 5:03:57 PM (4 years ago)

Author:

Chris Dumez

Message:

Crash under WebCookieCache::clearForHost()
​https://bugs.webkit.org/show_bug.cgi?id=209149
<rdar://problem/60453086>

Reviewed by Darin Adler.

Alternative fix for Bug 209149 based on comments from Darin.

• WebProcess/WebPage/WebCookieCache.cpp:

(WebKit::WebCookieCache::clearForHost):
(WebKit::WebCookieCache::pruneCacheIfNecessary):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/WebPage/WebCookieCache.cpp (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2020-03-16  Chris Dumez  <cdumez@apple.com>
+
+        Crash under WebCookieCache::clearForHost()
+        https://bugs.webkit.org/show_bug.cgi?id=209149
+        <rdar://problem/60453086>
+
+        Reviewed by Darin Adler.
+
+        Alternative fix for Bug 209149 based on comments from Darin.
+
+        * WebProcess/WebPage/WebCookieCache.cpp:
+        (WebKit::WebCookieCache::clearForHost):
+        (WebKit::WebCookieCache::pruneCacheIfNecessary):
+
 2020-03-16  Tim Horton  <timothy_horton@apple.com>
 

trunk/Source/WebKit/WebProcess/WebPage/WebCookieCache.cpp

@@ -103 +103 @@
 void WebCookieCache::clearForHost(const String& host)
 {
-    auto it = m_hostsWithInMemoryStorage.find(host);
-    if (it == m_hostsWithInMemoryStorage.end())
+    String removedHost = m_hostsWithInMemoryStorage.take(host);
+    if (removedHost.isNull())
         return;
 
-    m_hostsWithInMemoryStorage.remove(it);
-    inMemoryStorageSession().deleteCookiesForHostnames(Vector<String> { host });
+    inMemoryStorageSession().deleteCookiesForHostnames(Vector<String> { removedHost });
 #if HAVE(COOKIE_CHANGE_LISTENER_API)
-    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::UnsubscribeFromCookieChangeNotifications(HashSet<String> { host }), 0);
+    WebProcess::singleton().ensureNetworkProcessConnection().connection().send(Messages::NetworkConnectionToWebProcess::UnsubscribeFromCookieChangeNotifications(HashSet<String> { removedHost }), 0);
 #endif
 }
@@ -119 +118 @@
     static const unsigned maxCachedHosts = 5;
 
-    while (m_hostsWithInMemoryStorage.size() >= maxCachedHosts) {
-        String hostToRemove = *m_hostsWithInMemoryStorage.random();
-        clearForHost(hostToRemove);
-    }
+    while (m_hostsWithInMemoryStorage.size() >= maxCachedHosts)
+        clearForHost(*m_hostsWithInMemoryStorage.random());
 }