tree 460b2be1ebc7b884c9ca581e646b62b23fe8c93e
parent 22cb37c9310e008bc470ecf324f5472efa13eefd
author cdumez@apple.com <cdumez@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1575577248 +0000
committer cdumez@apple.com <cdumez@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1575577248 +0000

MESSAGE_CHECK BackForwardItemIdentifier on incoming IPC from the WebProcess
https://bugs.webkit.org/show_bug.cgi?id=204899

Reviewed by Ryosuke Niwa.

Source/WebCore:

* Sources.txt:
* history/BackForwardItemIdentifier.cpp: Added.
(WebCore::BackForwardItemIdentifier::isValid const):
* history/BackForwardItemIdentifier.h:
(WebCore::operator!=):

Source/WebKit:

MESSAGE_CHECK BackForwardItemIdentifier on incoming IPC from the WebProcess. This is important since we use this identifier
to look up the WebBackForwardListItem in a HashMap, and looking up a bad ID could corrupt said HashMap.

* Shared/WebBackForwardListItem.cpp:
Make sure the WebBackForwardListItem is always constructed and destroyed on the main thread, to avoid corrupting
the allItems() HashMap.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::willGoToBackForwardListItem):
(WebKit::WebPageProxy::backForwardGoToItemShared):
* UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::updateBackForwardItem):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@253163 268f45cc-cd09-0410-ab3c-d52691b4dbfc