Diff
Modified: trunk/Source/WebCore/ChangeLog (243458 => 243459)
--- trunk/Source/WebCore/ChangeLog 2019-03-25 21:14:50 UTC (rev 243458)
+++ trunk/Source/WebCore/ChangeLog 2019-03-25 21:21:50 UTC (rev 243459)
@@ -1,3 +1,52 @@
+2019-03-25 Alex Christensen <[email protected]>
+
+ Stop storing raw pointers to Documents
+ https://bugs.webkit.org/show_bug.cgi?id=196042
+
+ Reviewed by Geoff Garen.
+
+ Use WeakPtr instead! This could change some UAF bugs into null dereference crashes.
+
+ * css/CSSFontSelector.cpp:
+ (WebCore::CSSFontSelector::CSSFontSelector):
+ (WebCore::CSSFontSelector::addFontFaceRule):
+ (WebCore::CSSFontSelector::fontRangesForFamily):
+ * css/CSSFontSelector.h:
+ * css/MediaQueryMatcher.cpp:
+ (WebCore::MediaQueryMatcher::MediaQueryMatcher):
+ (WebCore::MediaQueryMatcher::matchMedia):
+ * css/MediaQueryMatcher.h:
+ * css/StyleSheetList.cpp:
+ (WebCore::StyleSheetList::StyleSheetList):
+ (WebCore::StyleSheetList::ownerNode const):
+ * css/StyleSheetList.h:
+ * css/ViewportStyleResolver.cpp:
+ (WebCore::ViewportStyleResolver::ViewportStyleResolver):
+ * css/ViewportStyleResolver.h:
+ * dom/Document.h:
+ (WebCore::Document::setTemplateDocumentHost):
+ (WebCore::Document::templateDocumentHost):
+ * dom/DocumentParser.cpp:
+ (WebCore::DocumentParser::DocumentParser):
+ * dom/DocumentParser.h:
+ (WebCore::DocumentParser::document const):
+ * dom/ScriptedAnimationController.cpp:
+ (WebCore::ScriptedAnimationController::ScriptedAnimationController):
+ * dom/ScriptedAnimationController.h:
+ * html/parser/HTMLScriptRunner.cpp:
+ (WebCore::HTMLScriptRunner::HTMLScriptRunner):
+ (WebCore::HTMLScriptRunner::runScript):
+ * html/parser/HTMLScriptRunner.h:
+ * loader/MediaResourceLoader.cpp:
+ (WebCore::MediaResourceLoader::MediaResourceLoader):
+ * loader/MediaResourceLoader.h:
+ * loader/cache/CachedResourceLoader.cpp:
+ (WebCore::CachedResourceLoader::canRequestInContentDispositionAttachmentSandbox const):
+ (WebCore::CachedResourceLoader::loadDone):
+ * loader/cache/CachedResourceLoader.h:
+ (WebCore::CachedResourceLoader::document const):
+ (WebCore::CachedResourceLoader::setDocument):
+
2019-03-25 Truitt Savell <[email protected]>
Unreviewed, rolling out r243419.
Modified: trunk/Source/WebCore/css/CSSFontSelector.cpp (243458 => 243459)
--- trunk/Source/WebCore/css/CSSFontSelector.cpp 2019-03-25 21:14:50 UTC (rev 243458)
+++ trunk/Source/WebCore/css/CSSFontSelector.cpp 2019-03-25 21:21:50 UTC (rev 243459)
@@ -62,7 +62,7 @@
static unsigned fontSelectorId;
CSSFontSelector::CSSFontSelector(Document& document)
- : m_document(&document)
+ : m_document(makeWeakPtr(document))
, m_cssFontFaceSet(CSSFontFaceSet::create(this))
, m_beginLoadingTimer(*this, &CSSFontSelector::beginLoadTimerFired)
, m_uniqueId(++fontSelectorId)
@@ -207,7 +207,7 @@
if (loadingBehavior)
fontFace->setLoadingBehavior(*loadingBehavior);
- CSSFontFace::appendSources(fontFace, srcList, m_document, isInitiatingElementInUserAgentShadowTree);
+ CSSFontFace::appendSources(fontFace, srcList, m_document.get(), isInitiatingElementInUserAgentShadowTree);
if (fontFace->computeFailureState())
return;
@@ -312,7 +312,7 @@
// FIXME: The spec (and Firefox) says user specified generic families (sans-serif etc.) should be resolved before the @font-face lookup too.
bool resolveGenericFamilyFirst = familyName == standardFamily;
- AtomicString familyForLookup = resolveGenericFamilyFirst ? resolveGenericFamily(m_document, fontDescription, familyName) : familyName;
+ AtomicString familyForLookup = resolveGenericFamilyFirst ? resolveGenericFamily(m_document.get(), fontDescription, familyName) : familyName;
auto* face = m_cssFontFaceSet->fontFace(fontDescription.fontSelectionRequest(), familyForLookup);
if (face) {
if (RuntimeEnabledFeatures::sharedFeatures().webAPIStatisticsEnabled()) {
@@ -322,7 +322,7 @@
return face->fontRanges(fontDescription);
}
if (!resolveGenericFamilyFirst)
- familyForLookup = resolveGenericFamily(m_document, fontDescription, familyName);
+ familyForLookup = resolveGenericFamily(m_document.get(), fontDescription, familyName);
auto font = FontCache::singleton().fontForFamily(fontDescription, familyForLookup);
if (RuntimeEnabledFeatures::sharedFeatures().webAPIStatisticsEnabled()) {
if (m_document)
Modified: trunk/Source/WebCore/css/CSSFontSelector.h (243458 => 243459)
--- trunk/Source/WebCore/css/CSSFontSelector.h 2019-03-25 21:14:50 UTC (rev 243458)
+++ trunk/Source/WebCore/css/CSSFontSelector.h 2019-03-25 21:21:50 UTC (rev 243459)
@@ -77,7 +77,7 @@
void registerForInvalidationCallbacks(FontSelectorClient&) final;
void unregisterForInvalidationCallbacks(FontSelectorClient&) final;
- Document* document() const { return m_document; }
+ Document* document() const { return m_document.get(); }
void beginLoadingFontSoon(CachedFont&);
@@ -103,7 +103,7 @@
};
Vector<PendingFontFaceRule> m_stagingArea;
- Document* m_document;
+ WeakPtr<Document> m_document;
RefPtr<FontFaceSet> m_fontFaceSet;
Ref<CSSFontFaceSet> m_cssFontFaceSet;
HashSet<FontSelectorClient*> m_clients;
Modified: trunk/Source/WebCore/css/MediaQueryMatcher.cpp (243458 => 243459)
--- trunk/Source/WebCore/css/MediaQueryMatcher.cpp 2019-03-25 21:14:50 UTC (rev 243458)
+++ trunk/Source/WebCore/css/MediaQueryMatcher.cpp 2019-03-25 21:21:50 UTC (rev 243459)
@@ -38,7 +38,7 @@
namespace WebCore {
MediaQueryMatcher::MediaQueryMatcher(Document& document)
- : m_document(&document)
+ : m_document(makeWeakPtr(document))
{
}
@@ -84,7 +84,7 @@
return nullptr;
auto media = MediaQuerySet::create(query, MediaQueryParserContext(*m_document));
- reportMediaQueryWarningIfNeeded(m_document, media.ptr());
+ reportMediaQueryWarningIfNeeded(m_document.get(), media.ptr());
bool result = evaluate(media.get());
return MediaQueryList::create(*this, WTFMove(media), result);
}
Modified: trunk/Source/WebCore/css/MediaQueryMatcher.h (243458 => 243459)
--- trunk/Source/WebCore/css/MediaQueryMatcher.h 2019-03-25 21:14:50 UTC (rev 243458)
+++ trunk/Source/WebCore/css/MediaQueryMatcher.h 2019-03-25 21:21:50 UTC (rev 243459)
@@ -66,7 +66,7 @@
std::unique_ptr<RenderStyle> documentElementUserAgentStyle() const;
String mediaType() const;
- Document* m_document;
+ WeakPtr<Document> m_document;
Vector<Listener> m_listeners;
// This value is incremented at style selector changes.
Modified: trunk/Source/WebCore/css/StyleSheetList.cpp (243458 => 243459)
--- trunk/Source/WebCore/css/StyleSheetList.cpp 2019-03-25 21:14:50 UTC (rev 243458)
+++ trunk/Source/WebCore/css/StyleSheetList.cpp 2019-03-25 21:21:50 UTC (rev 243459)
@@ -34,7 +34,7 @@
using namespace HTMLNames;
StyleSheetList::StyleSheetList(Document& document)
- : m_document(&document)
+ : m_document(makeWeakPtr(document))
{
}
@@ -57,7 +57,7 @@
Node* StyleSheetList::ownerNode() const
{
if (m_document)
- return m_document;
+ return m_document.get();
return m_shadowRoot;
}
Modified: trunk/Source/WebCore/css/StyleSheetList.h (243458 => 243459)
--- trunk/Source/WebCore/css/StyleSheetList.h 2019-03-25 21:14:50 UTC (rev 243458)
+++ trunk/Source/WebCore/css/StyleSheetList.h 2019-03-25 21:21:50 UTC (rev 243459)
@@ -23,6 +23,7 @@
#include <wtf/Forward.h>
#include <wtf/RefCounted.h>
#include <wtf/Vector.h>
+#include <wtf/WeakPtr.h>
namespace WebCore {
@@ -54,7 +55,7 @@
StyleSheetList(ShadowRoot&);
const Vector<RefPtr<StyleSheet>>& styleSheets() const;
- Document* m_document { nullptr };
+ WeakPtr<Document> m_document;
ShadowRoot* m_shadowRoot { nullptr };
Vector<RefPtr<StyleSheet>> m_detachedStyleSheets;
};
Modified: trunk/Source/WebCore/css/ViewportStyleResolver.cpp (243458 => 243459)
--- trunk/Source/WebCore/css/ViewportStyleResolver.cpp 2019-03-25 21:14:50 UTC (rev 243458)
+++ trunk/Source/WebCore/css/ViewportStyleResolver.cpp 2019-03-25 21:21:50 UTC (rev 243459)
@@ -42,7 +42,7 @@
namespace WebCore {
ViewportStyleResolver::ViewportStyleResolver(Document* document)
- : m_document(document)
+ : m_document(document ? makeWeakPtr(*document) : nullptr)
{
ASSERT(m_document);
}
Modified: trunk/Source/WebCore/css/ViewportStyleResolver.h (243458 => 243459)
--- trunk/Source/WebCore/css/ViewportStyleResolver.h 2019-03-25 21:14:50 UTC (rev 243458)
+++ trunk/Source/WebCore/css/ViewportStyleResolver.h 2019-03-25 21:21:50 UTC (rev 243459)
@@ -61,7 +61,7 @@
float getViewportArgumentValue(CSSPropertyID) const;
- Document* m_document;
+ WeakPtr<Document> m_document;
RefPtr<MutableStyleProperties> m_propertySet;
};
Modified: trunk/Source/WebCore/dom/Document.h (243458 => 243459)
--- trunk/Source/WebCore/dom/Document.h 2019-03-25 21:14:50 UTC (rev 243458)
+++ trunk/Source/WebCore/dom/Document.h 2019-03-25 21:21:50 UTC (rev 243459)
@@ -1344,8 +1344,8 @@
const Document* templateDocument() const;
Document& ensureTemplateDocument();
- void setTemplateDocumentHost(Document* templateDocumentHost) { m_templateDocumentHost = templateDocumentHost; }
- Document* templateDocumentHost() { return m_templateDocumentHost; }
+ void setTemplateDocumentHost(Document* templateDocumentHost) { m_templateDocumentHost = makeWeakPtr(templateDocumentHost); }
+ Document* templateDocumentHost() { return m_templateDocumentHost.get(); }
void didAssociateFormControl(Element&);
bool hasDisabledFieldsetElement() const { return m_disabledFieldsetElementsCount; }
@@ -1923,7 +1923,7 @@
LocaleIdentifierToLocaleMap m_localeCache;
RefPtr<Document> m_templateDocument;
- Document* m_templateDocumentHost { nullptr }; // Manually managed weakref (backpointer from m_templateDocument).
+ WeakPtr<Document> m_templateDocumentHost; // Manually managed weakref (backpointer from m_templateDocument).
Ref<CSSFontSelector> m_fontSelector;
Modified: trunk/Source/WebCore/dom/DocumentParser.cpp (243458 => 243459)
--- trunk/Source/WebCore/dom/DocumentParser.cpp 2019-03-25 21:14:50 UTC (rev 243458)
+++ trunk/Source/WebCore/dom/DocumentParser.cpp 2019-03-25 21:21:50 UTC (rev 243459)
@@ -33,7 +33,7 @@
DocumentParser::DocumentParser(Document& document)
: m_state(ParsingState)
, m_documentWasLoadedAsPartOfNavigation(false)
- , m_document(&document)
+ , m_document(makeWeakPtr(document))
{
}
Modified: trunk/Source/WebCore/dom/DocumentParser.h (243458 => 243459)
--- trunk/Source/WebCore/dom/DocumentParser.h 2019-03-25 21:14:50 UTC (rev 243458)
+++ trunk/Source/WebCore/dom/DocumentParser.h 2019-03-25 21:21:50 UTC (rev 243459)
@@ -62,7 +62,7 @@
virtual bool processingData() const { return false; }
// document() will return 0 after detach() is called.
- Document* document() const { ASSERT(m_document); return m_document; }
+ Document* document() const { ASSERT(m_document); return m_document.get(); }
bool isParsing() const { return m_state == ParsingState; }
bool isStopping() const { return m_state == StoppingState; }
@@ -114,7 +114,7 @@
// Every DocumentParser needs a pointer back to the document.
// m_document will be 0 after the parser is stopped.
- Document* m_document;
+ WeakPtr<Document> m_document;
};
} // namespace WebCore
Modified: trunk/Source/WebCore/dom/ScriptedAnimationController.cpp (243458 => 243459)
--- trunk/Source/WebCore/dom/ScriptedAnimationController.cpp 2019-03-25 21:14:50 UTC (rev 243458)
+++ trunk/Source/WebCore/dom/ScriptedAnimationController.cpp 2019-03-25 21:21:50 UTC (rev 243459)
@@ -55,7 +55,7 @@
namespace WebCore {
ScriptedAnimationController::ScriptedAnimationController(Document& document)
- : m_document(&document)
+ : m_document(makeWeakPtr(document))
, m_animationTimer(*this, &ScriptedAnimationController::animationTimerFired)
{
}
Modified: trunk/Source/WebCore/dom/ScriptedAnimationController.h (243458 => 243459)
--- trunk/Source/WebCore/dom/ScriptedAnimationController.h 2019-03-25 21:14:50 UTC (rev 243458)
+++ trunk/Source/WebCore/dom/ScriptedAnimationController.h 2019-03-25 21:21:50 UTC (rev 243459)
@@ -84,7 +84,7 @@
typedef Vector<RefPtr<RequestAnimationFrameCallback>> CallbackList;
CallbackList m_callbacks;
- Document* m_document;
+ WeakPtr<Document> m_document;
CallbackId m_nextCallbackId { 0 };
int m_suspendCount { 0 };
Modified: trunk/Source/WebCore/html/parser/HTMLScriptRunner.cpp (243458 => 243459)
--- trunk/Source/WebCore/html/parser/HTMLScriptRunner.cpp 2019-03-25 21:14:50 UTC (rev 243458)
+++ trunk/Source/WebCore/html/parser/HTMLScriptRunner.cpp 2019-03-25 21:21:50 UTC (rev 243459)
@@ -47,7 +47,7 @@
using namespace HTMLNames;
HTMLScriptRunner::HTMLScriptRunner(Document& document, HTMLScriptRunnerHost& host)
- : m_document(&document)
+ : m_document(makeWeakPtr(document))
, m_host(host)
, m_scriptNestingLevel(0)
, m_hasScriptsWaitingForStylesheets(false)
@@ -258,7 +258,7 @@
if (m_scriptNestingLevel == 1)
m_parserBlockingScript = PendingScript::create(scriptElement, scriptStartPosition);
else
- scriptElement.executeClassicScript(ScriptSourceCode(scriptElement.element().textContent(), documentURLForScriptExecution(m_document), scriptStartPosition, JSC::SourceProviderSourceType::Program, InlineClassicScript::create(scriptElement)));
+ scriptElement.executeClassicScript(ScriptSourceCode(scriptElement.element().textContent(), documentURLForScriptExecution(m_document.get()), scriptStartPosition, JSC::SourceProviderSourceType::Program, InlineClassicScript::create(scriptElement)));
} else
requestParsingBlockingScript(scriptElement);
}
Modified: trunk/Source/WebCore/html/parser/HTMLScriptRunner.h (243458 => 243459)
--- trunk/Source/WebCore/html/parser/HTMLScriptRunner.h 2019-03-25 21:14:50 UTC (rev 243458)
+++ trunk/Source/WebCore/html/parser/HTMLScriptRunner.h 2019-03-25 21:21:50 UTC (rev 243459)
@@ -28,6 +28,7 @@
#include "PendingScript.h"
#include <wtf/Deque.h>
+#include <wtf/WeakPtr.h>
#include <wtf/text/TextPosition.h>
namespace WebCore {
@@ -71,7 +72,7 @@
void stopWatchingForLoad(PendingScript&);
bool isPendingScriptReady(const PendingScript&);
- Document* m_document;
+ WeakPtr<Document> m_document;
HTMLScriptRunnerHost& m_host;
RefPtr<PendingScript> m_parserBlockingScript;
Deque<Ref<PendingScript>> m_scriptsToExecuteAfterParsing; // http://www.whatwg.org/specs/web-apps/current-work/#list-of-scripts-that-will-execute-when-the-document-has-finished-parsing
Modified: trunk/Source/WebCore/loader/MediaResourceLoader.cpp (243458 => 243459)
--- trunk/Source/WebCore/loader/MediaResourceLoader.cpp 2019-03-25 21:14:50 UTC (rev 243458)
+++ trunk/Source/WebCore/loader/MediaResourceLoader.cpp 2019-03-25 21:21:50 UTC (rev 243459)
@@ -43,7 +43,7 @@
MediaResourceLoader::MediaResourceLoader(Document& document, HTMLMediaElement& mediaElement, const String& crossOriginMode)
: ContextDestructionObserver(&document)
- , m_document(&document)
+ , m_document(makeWeakPtr(document))
, m_mediaElement(makeWeakPtr(mediaElement))
, m_crossOriginMode(crossOriginMode)
{
Modified: trunk/Source/WebCore/loader/MediaResourceLoader.h (243458 => 243459)
--- trunk/Source/WebCore/loader/MediaResourceLoader.h 2019-03-25 21:14:50 UTC (rev 243458)
+++ trunk/Source/WebCore/loader/MediaResourceLoader.h 2019-03-25 21:21:50 UTC (rev 243459)
@@ -52,7 +52,7 @@
RefPtr<PlatformMediaResource> requestResource(ResourceRequest&&, LoadOptions) final;
void removeResource(MediaResource&);
- Document* document() { return m_document; }
+ Document* document() { return m_document.get(); }
const String& crossOriginMode() const { return m_crossOriginMode; }
Vector<ResourceResponse> responsesForTesting() const { return m_responsesForTesting; }
@@ -61,7 +61,7 @@
private:
void contextDestroyed() override;
- Document* m_document;
+ WeakPtr<Document> m_document;
WeakPtr<HTMLMediaElement> m_mediaElement;
String m_crossOriginMode;
HashSet<MediaResource*> m_resources;
Modified: trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp (243458 => 243459)
--- trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp 2019-03-25 21:14:50 UTC (rev 243458)
+++ trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp 2019-03-25 21:21:50 UTC (rev 243459)
@@ -578,7 +578,7 @@
}
return true;
case CachedResource::Type::CSSStyleSheet:
- document = m_document;
+ document = m_document.get();
break;
default:
return true;
@@ -1303,7 +1303,7 @@
void CachedResourceLoader::loadDone(LoadCompletionType type, bool shouldPerformPostLoadActions)
{
RefPtr<DocumentLoader> protectDocumentLoader(m_documentLoader);
- RefPtr<Document> protectDocument(m_document);
+ RefPtr<Document> protectDocument(m_document.get());
ASSERT(shouldPerformPostLoadActions || type == LoadCompletionType::Cancel);
Modified: trunk/Source/WebCore/loader/cache/CachedResourceLoader.h (243458 => 243459)
--- trunk/Source/WebCore/loader/cache/CachedResourceLoader.h 2019-03-25 21:14:50 UTC (rev 243458)
+++ trunk/Source/WebCore/loader/cache/CachedResourceLoader.h 2019-03-25 21:21:50 UTC (rev 243459)
@@ -125,8 +125,8 @@
CachePolicy cachePolicy(CachedResource::Type, const URL&) const;
Frame* frame() const; // Can be null
- Document* document() const { return m_document; } // Can be null
- void setDocument(Document* document) { m_document = document; }
+ Document* document() const { return m_document.get(); } // Can be null
+ void setDocument(Document* document) { m_document = makeWeakPtr(document); }
void clearDocumentLoader() { m_documentLoader = nullptr; }
PAL::SessionID sessionID() const;
@@ -193,7 +193,7 @@
HashSet<String> m_validatedURLs;
mutable DocumentResourceMap m_documentResources;
- Document* m_document;
+ WeakPtr<Document> m_document;
DocumentLoader* m_documentLoader;
int m_requestCount;
