Skip to content
Permalink
Browse files
NetworkCache::Storage should protect itself when removing operations …
…from its maps

https://bugs.webkit.org/show_bug.cgi?id=180118

Patch by Youenn Fablet <youenn@apple.com> on 2017-11-28
Reviewed by Antti Koivisto.

The operations can contain ref to the Storage object and removing them from the map may destroy the Storage object

* NetworkProcess/cache/NetworkCacheStorage.cpp:
(WebKit::NetworkCache::Storage::remove):
(WebKit::NetworkCache::Storage::finishReadOperation):
(WebKit::NetworkCache::Storage::finishWriteOperation):
(WebKit::NetworkCache::Storage::traverse):

Canonical link: https://commits.webkit.org/196114@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@225253 268f45cc-cd09-0410-ab3c-d52691b4dbfc
  • Loading branch information
youennf authored and webkit-commit-queue committed Nov 29, 2017
1 parent b2d42e9 commit 9cac8972e3cbe08f3132dd5f787fc9362d83c8ef
Showing with 25 additions and 1 deletion.
  1. +15 −0 Source/WebKit/ChangeLog
  2. +10 −1 Source/WebKit/NetworkProcess/cache/NetworkCacheStorage.cpp
@@ -1,3 +1,18 @@
2017-11-28 Youenn Fablet <youenn@apple.com>

NetworkCache::Storage should protect itself when removing operations from its maps
https://bugs.webkit.org/show_bug.cgi?id=180118

Reviewed by Antti Koivisto.

The operations can contain ref to the Storage object and removing them from the map may destroy the Storage object

* NetworkProcess/cache/NetworkCacheStorage.cpp:
(WebKit::NetworkCache::Storage::remove):
(WebKit::NetworkCache::Storage::finishReadOperation):
(WebKit::NetworkCache::Storage::finishWriteOperation):
(WebKit::NetworkCache::Storage::traverse):

2017-11-28 Youenn Fablet <youenn@apple.com>

Register Documents as ServiceWorker clients to the StorageProcess
@@ -561,13 +561,15 @@ void Storage::remove(const Key& key)
if (!mayContain(key))
return;

auto protectedThis = makeRef(*this);

// We can't remove the key from the Bloom filter (but some false positives are expected anyway).
// For simplicity we also don't reduce m_approximateSize on removals.
// The next synchronization will update everything.

removeFromPendingWriteOperations(key);

serialBackgroundIOQueue().dispatch([this, protectedThis = makeRef(*this), key] () mutable {
serialBackgroundIOQueue().dispatch([this, protectedThis = WTFMove(protectedThis), key] () mutable {
deleteFiles(key);
RunLoop::main().dispatch([protectedThis = WTFMove(protectedThis)] { });
});
@@ -666,6 +668,8 @@ void Storage::finishReadOperation(ReadOperation& readOperation)
else if (!readOperation.isCanceled)
remove(readOperation.key);

auto protectedThis = makeRef(*this);

ASSERT(m_activeReadOperations.contains(&readOperation));
m_activeReadOperations.remove(&readOperation);

@@ -794,6 +798,8 @@ void Storage::finishWriteOperation(WriteOperation& writeOperation)
if (--writeOperation.activeCount)
return;

auto protectedThis = makeRef(*this);

m_activeWriteOperations.remove(&writeOperation);
dispatchPendingWriteOperations();

@@ -915,6 +921,9 @@ void Storage::traverse(const String& type, TraverseFlags flags, TraverseHandler&
}
RunLoop::main().dispatch([this, &traverseOperation] {
traverseOperation.handler(nullptr, { });

auto protectedThis = makeRef(*this);

m_activeTraverseOperations.remove(&traverseOperation);
});
});

0 comments on commit 9cac897

Please sign in to comment.