Merge r222520 - Harden our access to the vector of URL schemes.

https://bugs.webkit.org/show_bug.cgi?id=177470 <rdar://problem/33881522> Reviewed by Chris Dumez. Instead of asserting, use MESSAGE_CHECK so that we actually refuse to access an invalid iterator. * UIProcess/WebPageProxy.cpp: (WebKit::WebPageProxy::startURLSchemeTask): (WebKit::WebPageProxy::stopURLSchemeTask):
WebKit · Oct 17, 2017 · b7af337 · b7af337
1 parent dd6a855
commit b7af337
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 2 deletions.
diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
@@ -1,3 +1,17 @@
+2017-09-26  Brent Fulgham  <bfulgham@apple.com>
+
+        Harden our access to the vector of URL schemes.
+        https://bugs.webkit.org/show_bug.cgi?id=177470
+        <rdar://problem/33881522>
+
+        Reviewed by Chris Dumez.
+
+        Instead of asserting, use MESSAGE_CHECK so that we actually refuse to access an invalid iterator.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::startURLSchemeTask):
+        (WebKit::WebPageProxy::stopURLSchemeTask):
+
 2017-09-25  Alex Christensen  <achristensen@webkit.org>
 
         Separate form submission from PolicyChecker infrastructure

diff --git a/Source/WebKit/UIProcess/WebPageProxy.cpp b/Source/WebKit/UIProcess/WebPageProxy.cpp
@@ -6959,15 +6959,15 @@ WebURLSchemeHandler* WebPageProxy::urlSchemeHandlerForScheme(const String& schem
 void WebPageProxy::startURLSchemeTask(uint64_t handlerIdentifier, uint64_t taskIdentifier, const WebCore::ResourceRequest& request)
 {
     auto iterator = m_urlSchemeHandlersByIdentifier.find(handlerIdentifier);
-    ASSERT(iterator != m_urlSchemeHandlersByIdentifier.end());
+    MESSAGE_CHECK(iterator != m_urlSchemeHandlersByIdentifier.end());
 
     iterator->value->startTask(*this, taskIdentifier, request);
 }
 
 void WebPageProxy::stopURLSchemeTask(uint64_t handlerIdentifier, uint64_t taskIdentifier)
 {
     auto iterator = m_urlSchemeHandlersByIdentifier.find(handlerIdentifier);
-    ASSERT(iterator != m_urlSchemeHandlersByIdentifier.end());
+    MESSAGE_CHECK(iterator != m_urlSchemeHandlersByIdentifier.end());
 
     iterator->value->stopTask(*this, taskIdentifier);
 }