[webkit-changes] [WebKit/WebKit] 2143a0: Regression(276114 at main) Crash under WebCore::const...

[Chris Dumez]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 2143a0b27cbd7e7f5f258a5fdc410c4b6e959318
      https://github.com/WebKit/WebKit/commit/2143a0b27cbd7e7f5f258a5fdc410c4b6e959318
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2024-05-15 (Wed, 15 May 2024)

  Changed paths:
    M Source/WebKit/NetworkProcess/storage/SQLiteStorageArea.cpp

  Log Message:
  -----------
  Regression(276114 at main) Crash under WebCore::constructAndPrepareStatement
https://bugs.webkit.org/show_bug.cgi?id=274232
rdar://128126495

Reviewed by Sihui Liu.

In SQLiteStorageArea::setItem(), the code first calls `getItem()`. This call may
return with a StorageError, in which case `m_database` would be null after 276114 at main.
Because setItem() didn't early return on such error, it would proceed to call
`cachedStatement(StatementType::SetItem)` which would do a null dereference of `m_database`.

To address the issue, we now early return if `getItem()` fails with an error other than
`StorageError::ItemNotFound`.

* Source/WebKit/NetworkProcess/storage/SQLiteStorageArea.cpp:
(WebKit::SQLiteStorageArea::setItem):

Canonical link: https://commits.webkit.org/278845@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications