Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: a2ea9093812ea832e73fda46055da5d1d9056a55
https://github.com/WebKit/WebKit/commit/a2ea9093812ea832e73fda46055da5d1d9056a55
Author: Kristian Monsen <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
A
LayoutTests/ipc/report-web-content-cpu-time-invalid-activity-state-expected.txt
A LayoutTests/ipc/report-web-content-cpu-time-invalid-activity-state.html
M Source/WebKit/Scripts/webkit/messages.py
M Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in
M Source/WebKit/UIProcess/PerActivityStateCPUUsageSampler.cpp
M Source/WebKit/UIProcess/WebProcessPool.cpp
M Source/WebKit/UIProcess/WebProcessPool.h
M Source/WebKit/UIProcess/WebProcessPool.messages.in
M Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp
Log Message:
-----------
Validate WebCore::ActivityStateForCPUSampling when decoding
WebProcessPool::ReportWebContentCPUTime
https://bugs.webkit.org/show_bug.cgi?id=323648
rdar://185199111
Reviewed by Charlie Wolfe.
Declaring the argument as enum:uint8_t WebCore::ActivityStateForCPUSampling and
adding the enum to WebCoreArgumentCoders.serialization.in makes the
serialization
generator emit isValidEnum<WebCore::ActivityStateForCPUSampling>(uint8_t), which
the generated decoder now runs before the handler is called. An out-of-range
byte
therefore fails to decode: the message is dropped and the sending WebContent
process is terminated for sending an invalid message, instead of the UI process
aborting. Because the value handed to
PerActivityStateCPUUsageSampler::reportWebContentCPUTime is now guaranteed to be
one of the three enumerators, it can no longer equal StrongEnumHashTraits's
empty
(255) or deleted (254) sentinel, making the RELEASE_ASSERT(isValidKey(value)) in
HashTable::add() unreachable. Narrowing the wire type from uint64_t to uint8_t
also removes the truncation that turned 767 into 255 in the first place, so no
wider value can fold onto a sentinel.
Test: ipc/report-web-content-cpu-time-invalid-activity-state.html
*
LayoutTests/ipc/report-web-content-cpu-time-invalid-activity-state-expected.txt:
Added.
* LayoutTests/ipc/report-web-content-cpu-time-invalid-activity-state.html:
Added.
* Source/WebKit/Scripts/webkit/messages.py:
(headers_for_type):
* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:
* Source/WebKit/UIProcess/PerActivityStateCPUUsageSampler.cpp:
(WebKit::loggingKeyForActivityState):
* Source/WebKit/UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::reportWebContentCPUTime):
* Source/WebKit/UIProcess/WebProcessPool.h:
* Source/WebKit/UIProcess/WebProcessPool.messages.in:
* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:
(WebKit::WebChromeClient::reportProcessCPUTime):
Canonical link: https://commits.webkit.org/320752@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
