Title: [264018] trunk/Source/WebKit
- Revision
- 264018
- Author
- [email protected]
- Date
- 2020-07-07 08:20:09 -0700 (Tue, 07 Jul 2020)
Log Message
Fix CrashTracer reported in PDFPlugin::ByteRangeRequest::maybeComplete.
<rdar://problem/64884982> and https://bugs.webkit.org/show_bug.cgi?id=214026
Reviewed by Tim Horton.
No new tests (CrashTracer with no reproduction)
Due to the racy-ness of how PDFKit calls us on the background thread vs. what might be
happening with the main thread, sometimes the main thread is asked to handle a data
request either:
- Before m_data is allocated
or
- After it is deallocated
In either case it's okay to just not handle it.
Despite understanding how to reproduce in theory, writing a test case has been elusive.
* WebProcess/Plugins/PDF/PDFPlugin.mm:
(WebKit::PDFPlugin::ByteRangeRequest::maybeComplete): Null check m_data before doing anything with it.
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (264017 => 264018)
--- trunk/Source/WebKit/ChangeLog 2020-07-07 15:07:52 UTC (rev 264017)
+++ trunk/Source/WebKit/ChangeLog 2020-07-07 15:20:09 UTC (rev 264018)
@@ -1,3 +1,26 @@
+2020-07-07 Brady Eidson <[email protected]>
+
+ Fix CrashTracer reported in PDFPlugin::ByteRangeRequest::maybeComplete.
+ <rdar://problem/64884982> and https://bugs.webkit.org/show_bug.cgi?id=214026
+
+ Reviewed by Tim Horton.
+
+ No new tests (CrashTracer with no reproduction)
+
+ Due to the racy-ness of how PDFKit calls us on the background thread vs. what might be
+ happening with the main thread, sometimes the main thread is asked to handle a data
+ request either:
+ - Before m_data is allocated
+ or
+ - After it is deallocated
+
+ In either case it's okay to just not handle it.
+
+ Despite understanding how to reproduce in theory, writing a test case has been elusive.
+
+ * WebProcess/Plugins/PDF/PDFPlugin.mm:
+ (WebKit::PDFPlugin::ByteRangeRequest::maybeComplete): Null check m_data before doing anything with it.
+
2020-07-07 Carlos Garcia Campos <[email protected]>
REGRESSION(r262680): [GTK] Crash in WebKit::DropTarget::didPerformAction
Modified: trunk/Source/WebKit/WebProcess/Plugins/PDF/PDFPlugin.mm (264017 => 264018)
--- trunk/Source/WebKit/WebProcess/Plugins/PDF/PDFPlugin.mm 2020-07-07 15:07:52 UTC (rev 264017)
+++ trunk/Source/WebKit/WebProcess/Plugins/PDF/PDFPlugin.mm 2020-07-07 15:20:09 UTC (rev 264018)
@@ -1043,6 +1043,9 @@
bool PDFPlugin::ByteRangeRequest::maybeComplete(PDFPlugin& plugin)
{
+ if (!plugin.m_data)
+ return false;
+
if (plugin.m_streamedBytes >= m_position + m_count) {
completeWithBytes(CFDataGetBytePtr(plugin.m_data.get()) + m_position, m_count, plugin);
return true;
@@ -1055,6 +1058,7 @@
completeWithBytes(CFDataGetBytePtr(plugin.m_data.get()) + m_position, m_count, plugin);
return true;
}
+
return false;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
