Title: [264036] trunk/Source/WebKit
- Revision
- 264036
- Author
- [email protected]
- Date
- 2020-07-07 12:45:53 -0700 (Tue, 07 Jul 2020)
Log Message
Network process crashes in WebKit::StorageManagerSet::deleteSessionStorageForOrigins
https://bugs.webkit.org/show_bug.cgi?id=214050
Patch by Sihui Liu <[email protected]> on 2020-07-07
Reviewed by Chris Dumez.
In NetworkProcess::deleteAndRestrictWebsiteDataForRegistrableDomains, deleteSessionStorageForOrigins is called
in a callback without checking if session still exists.
* NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::deleteAndRestrictWebsiteDataForRegistrableDomains):
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (264035 => 264036)
--- trunk/Source/WebKit/ChangeLog 2020-07-07 19:43:02 UTC (rev 264035)
+++ trunk/Source/WebKit/ChangeLog 2020-07-07 19:45:53 UTC (rev 264036)
@@ -1,3 +1,16 @@
+2020-07-07 Sihui Liu <[email protected]>
+
+ Network process crashes in WebKit::StorageManagerSet::deleteSessionStorageForOrigins
+ https://bugs.webkit.org/show_bug.cgi?id=214050
+
+ Reviewed by Chris Dumez.
+
+ In NetworkProcess::deleteAndRestrictWebsiteDataForRegistrableDomains, deleteSessionStorageForOrigins is called
+ in a callback without checking if session still exists.
+
+ * NetworkProcess/NetworkProcess.cpp:
+ (WebKit::NetworkProcess::deleteAndRestrictWebsiteDataForRegistrableDomains):
+
2020-07-07 Chris Dumez <[email protected]>
WebContent process sometimes kills itself because it is receiving too much IPC from the UIProcess
Modified: trunk/Source/WebKit/NetworkProcess/NetworkProcess.cpp (264035 => 264036)
--- trunk/Source/WebKit/NetworkProcess/NetworkProcess.cpp 2020-07-07 19:43:02 UTC (rev 264035)
+++ trunk/Source/WebKit/NetworkProcess/NetworkProcess.cpp 2020-07-07 19:45:53 UTC (rev 264036)
@@ -1925,6 +1925,9 @@
if (m_storageManagerSet->contains(sessionID)) {
if (websiteDataTypes.contains(WebsiteDataType::SessionStorage)) {
m_storageManagerSet->getSessionStorageOrigins(sessionID, [protectedThis = makeRef(*this), this, sessionID, callbackAggregator, domainsToDeleteAllNonCookieWebsiteDataFor](auto&& origins) {
+ if (!m_storageManagerSet->contains(sessionID))
+ return;
+
auto originsToDelete = filterForRegistrableDomains(origins, domainsToDeleteAllNonCookieWebsiteDataFor, callbackAggregator->m_domains);
m_storageManagerSet->deleteSessionStorageForOrigins(sessionID, originsToDelete, [callbackAggregator] { });
});
@@ -1932,6 +1935,9 @@
if (websiteDataTypes.contains(WebsiteDataType::LocalStorage)) {
m_storageManagerSet->getLocalStorageOrigins(sessionID, [protectedThis = makeRef(*this), this, sessionID, callbackAggregator, domainsToDeleteAllNonCookieWebsiteDataFor](auto&& origins) {
+ if (!m_storageManagerSet->contains(sessionID))
+ return;
+
auto originsToDelete = filterForRegistrableDomains(origins, domainsToDeleteAllNonCookieWebsiteDataFor, callbackAggregator->m_domains);
m_storageManagerSet->deleteLocalStorageForOrigins(sessionID, originsToDelete, [callbackAggregator] { });
});
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
