Title: [271322] trunk
- Revision
- 271322
- Author
- [email protected]
- Date
- 2021-01-08 14:35:28 -0800 (Fri, 08 Jan 2021)
Log Message
[macOS] -[WKWebView acceptsFirstMouse:] sometimes crashes in IPC::Connection::createSyncMessageEncoder
https://bugs.webkit.org/show_bug.cgi?id=220469
<rdar://problem/72319199>
Reviewed by Chris Dumez.
Source/WebKit:
When sending IPC to the web process from the UI process, it's possible for the `WebProcessProxy`'s IPC
connection to be null in the case where the web process is still in the act of launching. In the case of
asynchronous IPC, we handle this by queueing the IPC message on the `WebProcessProxy` in the case where the
connection hasn't been created yet (refer to `AuxiliaryProcessProxy::sendMessage`). However, in the case where
we're sending a sync message, we assume that the IPC connection exists in `MessageSender::sendSync`, which
causes us to crash with a null dereference.
To fix this, remove the debug assertion in `MessageSender::sendSync` and return a null `SendSyncResult` in the
case where the connection has not been created.
Test: WebKit2.AcceptsFirstMouseDuringWebProcessLaunch
* Platform/IPC/MessageSender.h:
Tools:
Add an API test that exercises the crash by calling into `-acceptsFirstMouse:` during web process launch.
* TestWebKitAPI/Tests/mac/AcceptsFirstMouse.mm:
(TestWebKitAPI::TEST):
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (271321 => 271322)
--- trunk/Source/WebKit/ChangeLog 2021-01-08 22:18:26 UTC (rev 271321)
+++ trunk/Source/WebKit/ChangeLog 2021-01-08 22:35:28 UTC (rev 271322)
@@ -1,3 +1,25 @@
+2021-01-08 Wenson Hsieh <[email protected]>
+
+ [macOS] -[WKWebView acceptsFirstMouse:] sometimes crashes in IPC::Connection::createSyncMessageEncoder
+ https://bugs.webkit.org/show_bug.cgi?id=220469
+ <rdar://problem/72319199>
+
+ Reviewed by Chris Dumez.
+
+ When sending IPC to the web process from the UI process, it's possible for the `WebProcessProxy`'s IPC
+ connection to be null in the case where the web process is still in the act of launching. In the case of
+ asynchronous IPC, we handle this by queueing the IPC message on the `WebProcessProxy` in the case where the
+ connection hasn't been created yet (refer to `AuxiliaryProcessProxy::sendMessage`). However, in the case where
+ we're sending a sync message, we assume that the IPC connection exists in `MessageSender::sendSync`, which
+ causes us to crash with a null dereference.
+
+ To fix this, remove the debug assertion in `MessageSender::sendSync` and return a null `SendSyncResult` in the
+ case where the connection has not been created.
+
+ Test: WebKit2.AcceptsFirstMouseDuringWebProcessLaunch
+
+ * Platform/IPC/MessageSender.h:
+
2021-01-08 Jiewen Tan <[email protected]>
[WebAuthn] Adopt new UI for the update flow
Modified: trunk/Source/WebKit/Platform/IPC/MessageSender.h (271321 => 271322)
--- trunk/Source/WebKit/Platform/IPC/MessageSender.h 2021-01-08 22:18:26 UTC (rev 271321)
+++ trunk/Source/WebKit/Platform/IPC/MessageSender.h 2021-01-08 22:35:28 UTC (rev 271322)
@@ -67,9 +67,10 @@
template<typename T>
SendSyncResult sendSync(T&& message, typename T::Reply&& reply, uint64_t destinationID, Seconds timeout = Seconds::infinity(), OptionSet<SendSyncOption> sendSyncOptions = { })
{
- ASSERT(messageSenderConnection());
+ if (auto* connection = messageSenderConnection())
+ return connection->sendSync(WTFMove(message), WTFMove(reply), destinationID, timeout, sendSyncOptions);
- return messageSenderConnection()->sendSync(WTFMove(message), WTFMove(reply), destinationID, timeout, sendSyncOptions);
+ return { };
}
template<typename U, typename T>
Modified: trunk/Tools/ChangeLog (271321 => 271322)
--- trunk/Tools/ChangeLog 2021-01-08 22:18:26 UTC (rev 271321)
+++ trunk/Tools/ChangeLog 2021-01-08 22:35:28 UTC (rev 271322)
@@ -1,3 +1,16 @@
+2021-01-08 Wenson Hsieh <[email protected]>
+
+ [macOS] -[WKWebView acceptsFirstMouse:] sometimes crashes in IPC::Connection::createSyncMessageEncoder
+ https://bugs.webkit.org/show_bug.cgi?id=220469
+ <rdar://problem/72319199>
+
+ Reviewed by Chris Dumez.
+
+ Add an API test that exercises the crash by calling into `-acceptsFirstMouse:` during web process launch.
+
+ * TestWebKitAPI/Tests/mac/AcceptsFirstMouse.mm:
+ (TestWebKitAPI::TEST):
+
2021-01-08 Sihui Liu <[email protected]>
Stop using MediaRecorder in API test WebKit2.SpeechRecognitionErrorWhenStartingAudioCaptureOnDifferentPage
Modified: trunk/Tools/TestWebKitAPI/Tests/mac/AcceptsFirstMouse.mm (271321 => 271322)
--- trunk/Tools/TestWebKitAPI/Tests/mac/AcceptsFirstMouse.mm 2021-01-08 22:18:26 UTC (rev 271321)
+++ trunk/Tools/TestWebKitAPI/Tests/mac/AcceptsFirstMouse.mm 2021-01-08 22:35:28 UTC (rev 271322)
@@ -24,8 +24,10 @@
*/
#import "config.h"
+#import "TestNavigationDelegate.h"
+#import "TestWKWebView.h"
#import "WebKitAgnosticTest.h"
-
+#import <Carbon/Carbon.h>
#import <wtf/RetainPtr.h>
@interface NSApplication (TestWebKitAPINSApplicationDetails)
@@ -75,4 +77,15 @@
runWebKit2Test();
}
+TEST(WebKit2, AcceptsFirstMouseDuringWebProcessLaunch)
+{
+ auto webView = adoptNS([[TestWKWebView alloc] initWithFrame:NSMakeRect(0, 0, 400, 400)]);
+ [webView loadHTMLString:@"<body>" baseURL:nil];
+
+ auto mouseEvent = [NSEvent enterExitEventWithType:NSEventTypeMouseEntered location:NSMakePoint(1, 1) modifierFlags:0 timestamp:GetCurrentEventTime() windowNumber:[webView window].windowNumber context:NSGraphicsContext.currentContext eventNumber:1 trackingNumber:1 userData:nil];
+ [webView acceptsFirstMouse:mouseEvent];
+
+ [webView _test_waitForDidFinishNavigation];
+}
+
} // namespace TestWebKitAPI
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
