Skip to content

Commit 4dd9ed5

Browse files
kkinnunen-applemnutt
authored andcommitted
MessageEvent::m_data lock is not held when accessed
https://bugs.webkit.org/show_bug.cgi?id=258806 rdar://111681401 Reviewed by Yusuke Suzuki. The unnamed Locker instance is discarded, releasing the lock. Fix by naming the instance. Add declarations to prevent similar bugs. * Source/WTF/wtf/Locker.h: (WTF::Locker::Locker): Deleted. (WTF::Locker::~Locker): Deleted. (WTF::Locker::tryLock): Deleted. (WTF::Locker::lockable): Deleted. (WTF::Locker::operator bool const): Deleted. (WTF::Locker::unlockEarly): Deleted. (WTF::Locker::operator=): Deleted. (WTF::Locker::unlock): Deleted. (WTF::Locker::lock): Deleted. * Source/WebCore/dom/MessageEvent.cpp: (WebCore::MessageEvent::initMessageEvent): (WebCore::MessageEvent::memoryCost const): * Source/WebCore/dom/MessageEvent.h: Canonical link: https://commits.webkit.org/265732@main
1 parent 23b6b78 commit 4dd9ed5

File tree

3 files changed

+4
-4
lines changed

3 files changed

+4
-4
lines changed

Source/WTF/wtf/Locker.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ using AdoptLockTag = std::adopt_lock_t;
5959
constexpr AdoptLockTag AdoptLock;
6060

6161
template<typename T>
62-
class Locker : public AbstractLocker {
62+
class [[nodiscard]] Locker : public AbstractLocker { // NOLINT
6363
public:
6464
explicit Locker(T& lockable) : m_lockable(&lockable) { lock(); }
6565
explicit Locker(T* lockable) : m_lockable(lockable) { lock(); }

Source/WebCore/dom/MessageEvent.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ void MessageEvent::initMessageEvent(const AtomString& type, bool canBubble, bool
113113
initEvent(type, canBubble, cancelable);
114114

115115
{
116-
Locker { m_concurrentDataAccessLock };
116+
Locker locker { m_concurrentDataAccessLock };
117117
m_data = JSValueTag { };
118118
}
119119
// FIXME: This code is wrong: we should emit a write-barrier. Otherwise, GC can collect it.
@@ -134,7 +134,7 @@ EventInterface MessageEvent::eventInterface() const
134134

135135
size_t MessageEvent::memoryCost() const
136136
{
137-
Locker { m_concurrentDataAccessLock };
137+
Locker locker { m_concurrentDataAccessLock };
138138
return WTF::switchOn(m_data, [] (JSValueTag) -> size_t {
139139
return 0;
140140
}, [] (const Ref<SerializedScriptValue>& data) -> size_t {

Source/WebCore/dom/MessageEvent.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ class MessageEvent final : public Event {
9494

9595
EventInterface eventInterface() const final;
9696

97-
DataType m_data;
97+
DataType m_data WTF_GUARDED_BY_LOCK(m_concurrentDataAccessLock);
9898
String m_origin;
9999
String m_lastEventId;
100100
std::optional<MessageEventSource> m_source;

0 commit comments

Comments
 (0)