Bug 234724 – SharedBuffer::takeData() is still dangerous

• Component: WebCore Misc.
• Status: RESOLVED FIXED

[Jean-Yves Avenard [:jya]]

This issue was first addressed in bug 228161

What this change did was to ensure that there was only one reference to the SharedBuffer before taking the data's vector otherwise would return a copy instead.

But this isn't a sufficient condition to ensure that the DataSegment itself isn't shared. The same DataSegment can be shared across multiple SharedBuffers

Consider the following code:

auto buffer = SharedBuffer::create("my_data", 7);
auto copy = buffer->copy();

auto innerData = copy->extractData();

now the original SharedBuffer `buffer` is empty (but still has a size of 7) as SharedBuffer::copy() will only do a shallow copy of the SharedBuffer.

This is what caused the remaining errors in bug 232424.

[Radar WebKit Bug Importer]

<rdar://problem/86957233>

[Jean-Yves Avenard [:jya]]

Created attachment 448059 [details]
Patch

[EWS]

Committed r287489 (245624@main): <https://commits.webkit.org/245624@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 448059 [details].