Title: [280828] releases/WebKitGTK/webkit-2.32/Source/WebCore
- Revision
- 280828
- Author
- [email protected]
- Date
- 2021-08-10 01:57:20 -0700 (Tue, 10 Aug 2021)
Log Message
Merge r273692 - Protect AudioWorkletGlobalScope::registerProcessor() against re-entry
https://bugs.webkit.org/show_bug.cgi?id=222567
<rdar://74860464>
Reviewed by Eric Carlson.
AudioWorkletGlobalScope::registerProcessor() checks if 'name' is in m_processorConstructorMap
then does some checks that potentially run JS and thus call registerProcessor() again (potentially
with the same name). To address this, we now check the map again after potentially running the
JS code.
* Modules/webaudio/AudioWorkletGlobalScope.cpp:
(WebCore::AudioWorkletGlobalScope::registerProcessor):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog (280827 => 280828)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-08-10 08:41:46 UTC (rev 280827)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-08-10 08:57:20 UTC (rev 280828)
@@ -1,3 +1,19 @@
+2021-03-01 Chris Dumez <[email protected]>
+
+ Protect AudioWorkletGlobalScope::registerProcessor() against re-entry
+ https://bugs.webkit.org/show_bug.cgi?id=222567
+ <rdar://74860464>
+
+ Reviewed by Eric Carlson.
+
+ AudioWorkletGlobalScope::registerProcessor() checks if 'name' is in m_processorConstructorMap
+ then does some checks that potentially run JS and thus call registerProcessor() again (potentially
+ with the same name). To address this, we now check the map again after potentially running the
+ JS code.
+
+ * Modules/webaudio/AudioWorkletGlobalScope.cpp:
+ (WebCore::AudioWorkletGlobalScope::registerProcessor):
+
2021-03-03 Julian Gonzalez <[email protected]>
Crash in removeSymbolElementsFromSubtree()
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/Modules/webaudio/AudioWorkletGlobalScope.cpp (280827 => 280828)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/Modules/webaudio/AudioWorkletGlobalScope.cpp 2021-08-10 08:41:46 UTC (rev 280827)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/Modules/webaudio/AudioWorkletGlobalScope.cpp 2021-08-10 08:57:20 UTC (rev 280828)
@@ -82,13 +82,13 @@
auto scope = DECLARE_THROW_SCOPE(vm);
if (!jsConstructor->isConstructor(vm))
- return Exception { TypeError, "Class definitition passed to registerProcessor() is not a constructor"_s };
+ return Exception { TypeError, "Class definition passed to registerProcessor() is not a constructor"_s };
auto prototype = jsConstructor->getPrototype(vm, globalObject);
RETURN_IF_EXCEPTION(scope, Exception { ExistingExceptionError });
if (!prototype.isObject())
- return Exception { TypeError, "Class definitition passed to registerProcessor() has invalid prototype"_s };
+ return Exception { TypeError, "Class definition passed to registerProcessor() has invalid prototype"_s };
auto parameterDescriptorsValue = jsConstructor->get(globalObject, JSC::Identifier::fromString(vm, "parameterDescriptors"));
RETURN_IF_EXCEPTION(scope, Exception { ExistingExceptionError });
@@ -110,8 +110,12 @@
}
}
- m_processorConstructorMap.add(name, WTFMove(processorContructor));
+ auto addResult = m_processorConstructorMap.add(name, WTFMove(processorContructor));
+ // We've already checked at the beginning of this function but then we ran some JS so we need to check again.
+ if (!addResult.isNewEntry)
+ return Exception { NotSupportedError, "A processor was already registered with this name"_s };
+
thread().messagingProxy().postTaskToAudioWorklet([name = name.isolatedCopy(), parameterDescriptors = crossThreadCopy(parameterDescriptors)](AudioWorklet& worklet) mutable {
ASSERT(isMainThread());
if (auto* audioContext = worklet.audioContext())
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
