Attachment 341867 Details for Bug 186211 – Patch for landing

[patch] Patch for landing

bug-186211-20180603104955.patch (text/plain), 3.56 KB, created by Brent Fulgham on 2018-06-03 10:49:56 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Brent Fulgham

Created: 2018-06-03 10:49:56 PDT

Size: 3.56 KB

patch

obsolete

>Subversion Revision: 232450
>diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
>index e1062723109b028487c5245e09079b66c41a80dd..eaa082cceb5e276f71fa5e9a137a7ee98d7cf84f 100644
>--- a/Source/WebKit/ChangeLog
>+++ b/Source/WebKit/ChangeLog
>@@ -1,3 +1,21 @@
>+2018-06-03  Brent Fulgham  <bfulgham@apple.com>
>+
>+        Make sure that the fencePort received over IPC has the expected disposition (SEND)
>+        https://bugs.webkit.org/show_bug.cgi?id=186211
>+        <rdar://problem/37814171>
>+
>+        Reviewed by Geoffrey Garen.
>+
>+        It is possible (though very unlikely) for a message to be recevied that has the wrong mach port disposition.
>+        If this happens, we shouldn't manipulate the passed mach_port_t or pass it on to other API. We already
>+        drop messages that violate this expectation in the IPC layer, but code handling IPC::Attachment data types
>+        are not checking this value.
>+
>+        * WebProcess/WebPage/WebPage.cpp:
>+        (WebKit::WebPage::setTopContentInsetFenced):
>+        * WebProcess/cocoa/VideoFullscreenManager.mm:
>+        (WebKit::VideoFullscreenManager::setVideoLayerFrameFenced):
>+
> 2018-06-02  Chris Dumez  <cdumez@apple.com>
> 
>         Unreviewed, rolling out r232275.
>diff --git a/Source/WebKit/WebProcess/WebPage/WebPage.cpp b/Source/WebKit/WebProcess/WebPage/WebPage.cpp
>index e3bfe5df8cc8e14ece65bc4ab03a686c6a1b06b4..b57f66faadb949cbd5765bb380b35a3b9b5c24fe 100644
>--- a/Source/WebKit/WebProcess/WebPage/WebPage.cpp
>+++ b/Source/WebKit/WebProcess/WebPage/WebPage.cpp
>@@ -2665,6 +2665,11 @@ void WebPage::setDrawsBackground(bool drawsBackground)
> #if PLATFORM(COCOA)
> void WebPage::setTopContentInsetFenced(float contentInset, IPC::Attachment fencePort)
> {
>+    if (fencePort.disposition() != MACH_MSG_TYPE_MOVE_SEND) {
>+        LOG(Layers, "WebPage::setTopContentInsetFenced(%g, fencePort) Received an invalid fence port: %d, disposition: %d", contentInset, fencePort.port(), fencePort.disposition());
>+        return;
>+    }
>+
>     m_drawingArea->addFence(MachSendRight::create(fencePort.port()));
> 
>     setTopContentInset(contentInset);
>diff --git a/Source/WebKit/WebProcess/cocoa/VideoFullscreenManager.mm b/Source/WebKit/WebProcess/cocoa/VideoFullscreenManager.mm
>index a80883acf48384704cd350df04af985ef06952b9..f9fd6afea18ec398d1fc740a58de0af2ca2a3289 100644
>--- a/Source/WebKit/WebProcess/cocoa/VideoFullscreenManager.mm
>+++ b/Source/WebKit/WebProcess/cocoa/VideoFullscreenManager.mm
>@@ -564,6 +564,11 @@ void VideoFullscreenManager::setVideoLayerFrameFenced(uint64_t contextId, WebCor
> {
>     LOG(Fullscreen, "VideoFullscreenManager::setVideoLayerFrameFenced(%p, %x)", this, contextId);
> 
>+    if (fencePort.disposition() != MACH_MSG_TYPE_MOVE_SEND) {
>+        LOG(Fullscreen, "VideoFullscreenManager::setVideoLayerFrameFenced(%p, %x) Received an invalid fence port: %d, disposition: %d", this, contextId, fencePort.port(), fencePort.disposition());
>+        return;
>+    }
>+
>     RefPtr<VideoFullscreenModelVideoElement> model;
>     RefPtr<VideoFullscreenInterfaceContext> interface;
>     std::tie(model, interface) = ensureModelAndInterface(contextId);
>@@ -573,8 +578,8 @@ void VideoFullscreenManager::setVideoLayerFrameFenced(uint64_t contextId, WebCor
>         bounds = FloatRect(0, 0, videoRect.width(), videoRect.height());
>     }
>     
>-    if (interface->layerHostingContext())
>-        interface->layerHostingContext()->setFencePort(fencePort.port());
>+    if (auto* context = interface->layerHostingContext())
>+        context->setFencePort(fencePort.port());
>     model->setVideoLayerFrame(bounds);
>     deallocateSendRightSafely(fencePort.port());
> }

Actions: View | Formatted Diff | Diff

Attachments on bug 186211: 341800 | 341837 | 341867