Bug 215737 - IPC::encodeSharedBuffer combines SharedBuffer data segments when copying to SharedMemory
Summary: IPC::encodeSharedBuffer combines SharedBuffer data segments when copying to S...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Andy Estes
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2020-08-21 11:12 PDT by Andy Estes
Modified: 2020-08-21 14:29 PDT (History)
4 users (show)

See Also:


Attachments
Patch (3.16 KB, patch)
2020-08-21 11:15 PDT, Andy Estes
no flags Details | Formatted Diff | Diff
Patch for landing (4.10 KB, patch)
2020-08-21 13:16 PDT, Andy Estes
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Andy Estes 2020-08-21 11:12:58 PDT Comment hidden (obsolete)
Comment 1 Andy Estes 2020-08-21 11:13:28 PDT
WebKit::encodeSharedBuffer() needlessly combines SharedBuffer data segments when creating a SharedMemory
Comment 2 Radar WebKit Bug Importer 2020-08-21 11:14:13 PDT
<rdar://problem/67568099>
Comment 3 Andy Estes 2020-08-21 11:15:50 PDT
Created attachment 407020 [details]
Patch
Comment 4 Andy Estes 2020-08-21 11:15:52 PDT Comment hidden (obsolete)
Comment 5 Darin Adler 2020-08-21 12:20:57 PDT
Comment on attachment 407020 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=407020&action=review

> Source/WebKit/ChangeLog:11
> +        * Platform/SharedMemory.cpp:
> +        (WebKit::SharedMemory::copyBuffer): Changed iterate data segments using a for loop rather
> +        than repeated calls to SharedBuffer::getSomeData().

So this is just a coding style improvement, not the fix?

> Source/WebKit/ChangeLog:14
> +        * Shared/WebCoreArgumentCoders.cpp:
> +        (IPC::encodeSharedBuffer): Changed to call SharedMemory::copyBuffer() rather than
> +        SharedMemory::allocate() + memcpy.

And this is the fix?

> Source/WebKit/Platform/SharedMemory.cpp:44
>      char* const sharedMemoryPtr = reinterpret_cast<char*>(sharedMemory->data());

This should be static_cast, not reinterpret_cast.

I also suggest using auto rather than char* const.

> Source/WebKit/Platform/SharedMemory.cpp:46
> +        ASSERT(segmentEntry.beginPosition + segmentEntry.segment->size() <= sharedMemory->size());

While it’s OK to assert this, seems unnecessary.

> Source/WebKit/Platform/SharedMemory.cpp:48
> +        auto result = memcpy(sharedMemoryPtr + segmentEntry.beginPosition, segmentEntry.segment->data(), segmentEntry.segment->size());
> +        ASSERT_UNUSED(result, result == sharedMemoryPtr + segmentEntry.beginPosition);

This seems strange in both the old and new code. Why look at the return value from memcpy? Just not what we normally need to do.

> Source/WebKit/Shared/WebCoreArgumentCoders.cpp:144
> +    auto sharedMemoryBuffer = SharedMemory::copyBuffer(*buffer);
>      sharedMemoryBuffer->createHandle(handle, SharedMemory::Protection::ReadOnly);

Not sure about the failure handling here. For some reason copyBuffer returns null when it fails, rather than doing an explicit crash. Seems like we should be doing an explicit crash rather than just letting it crash "naturally" by dereferencing null.

But this is no different from when we were calling allocate directly. As a cleanup I suggest we tighten this up later and crash rather than returning null. If we really need the "return null" behavior I suggest we add a tryAllocate and a tryCopyBuffer.
Comment 6 Andy Estes 2020-08-21 13:16:54 PDT
Created attachment 407025 [details]
Patch for landing
Comment 7 Andy Estes 2020-08-21 13:36:09 PDT
(In reply to Darin Adler from comment #5)
> Comment on attachment 407020 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=407020&action=review
> 
> > Source/WebKit/ChangeLog:11
> > +        * Platform/SharedMemory.cpp:
> > +        (WebKit::SharedMemory::copyBuffer): Changed iterate data segments using a for loop rather
> > +        than repeated calls to SharedBuffer::getSomeData().
> 
> So this is just a coding style improvement, not the fix?
> 
> > Source/WebKit/ChangeLog:14
> > +        * Shared/WebCoreArgumentCoders.cpp:
> > +        (IPC::encodeSharedBuffer): Changed to call SharedMemory::copyBuffer() rather than
> > +        SharedMemory::allocate() + memcpy.
> 
> And this is the fix?

Yeah. I've updated the ChangeLog with better words.
Comment 8 EWS 2020-08-21 14:29:24 PDT
Committed r266014: <https://trac.webkit.org/changeset/266014>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 407025 [details].