Title: [276712] trunk/Source/WebKit
- Revision
- 276712
- Author
- [email protected]
- Date
- 2021-04-28 08:20:48 -0700 (Wed, 28 Apr 2021)
Log Message
Crash under GPUProcessProxy::getGPUProcessConnection()
https://bugs.webkit.org/show_bug.cgi?id=224017
<rdar://75146104>
Reviewed by Darin Adler.
The crash would happen when replyToPendingMessages() get called in the AuxiliaryProcessProxy
destructor and there would be a pending getGPUProcessConnection() IPC. The lambda in
WebProcessPool::getGPUProcessConnection() would check if a WeakPtr to the WebProcessPool is
valid before calling `ensureGPUProcess().getGPUProcessConnection()`. However, at this point,
the WebProcessPool destructor is still running so the WeakPtr is still valid but
`ensureGPUProcess().getGPUProcessConnection()` will crash because the GPUProcessProxy
destructor has already run.
* UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::~WebProcessPool):
Drop code that was causing the GPUProcessProxy to reply to all its pending IPC messages whenenever
a WebProcessPool gets destroyed. This is incorrect since a GPUProcessProxy may be shared by several
WebProcessPool objects. Note that the AuxiliaryProcessProxy destructor already takes care of
calling replyToPendingMessages().
(WebKit::WebProcessPool::getGPUProcessConnection):
Protect the WebProcessPool is the lambda to prevent the case where this lambda gets called and the
WebProcessPool & GPUProcessProxy are in the middle of destruction.
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (276711 => 276712)
--- trunk/Source/WebKit/ChangeLog 2021-04-28 14:33:39 UTC (rev 276711)
+++ trunk/Source/WebKit/ChangeLog 2021-04-28 15:20:48 UTC (rev 276712)
@@ -1,3 +1,30 @@
+2021-04-28 Chris Dumez <[email protected]>
+
+ Crash under GPUProcessProxy::getGPUProcessConnection()
+ https://bugs.webkit.org/show_bug.cgi?id=224017
+ <rdar://75146104>
+
+ Reviewed by Darin Adler.
+
+ The crash would happen when replyToPendingMessages() get called in the AuxiliaryProcessProxy
+ destructor and there would be a pending getGPUProcessConnection() IPC. The lambda in
+ WebProcessPool::getGPUProcessConnection() would check if a WeakPtr to the WebProcessPool is
+ valid before calling `ensureGPUProcess().getGPUProcessConnection()`. However, at this point,
+ the WebProcessPool destructor is still running so the WeakPtr is still valid but
+ `ensureGPUProcess().getGPUProcessConnection()` will crash because the GPUProcessProxy
+ destructor has already run.
+
+ * UIProcess/WebProcessPool.cpp:
+ (WebKit::WebProcessPool::~WebProcessPool):
+ Drop code that was causing the GPUProcessProxy to reply to all its pending IPC messages whenenever
+ a WebProcessPool gets destroyed. This is incorrect since a GPUProcessProxy may be shared by several
+ WebProcessPool objects. Note that the AuxiliaryProcessProxy destructor already takes care of
+ calling replyToPendingMessages().
+
+ (WebKit::WebProcessPool::getGPUProcessConnection):
+ Protect the WebProcessPool is the lambda to prevent the case where this lambda gets called and the
+ WebProcessPool & GPUProcessProxy are in the middle of destruction.
+
2021-04-28 Kimmo Kinnunen <[email protected]>
Asserting that function or variable is accessed in a certain thread should be simpler and more robust
Modified: trunk/Source/WebKit/UIProcess/WebProcessPool.cpp (276711 => 276712)
--- trunk/Source/WebKit/UIProcess/WebProcessPool.cpp 2021-04-28 14:33:39 UTC (rev 276711)
+++ trunk/Source/WebKit/UIProcess/WebProcessPool.cpp 2021-04-28 15:20:48 UTC (rev 276712)
@@ -360,11 +360,6 @@
UIGamepadProvider::singleton().processPoolStoppedUsingGamepads(*this);
#endif
-#if ENABLE(GPU_PROCESS)
- if (m_gpuProcess)
- m_gpuProcess->replyToPendingMessages();
-#endif
-
// Only remaining processes should be pre-warmed ones as other keep the process pool alive.
while (!m_processes.isEmpty()) {
auto& process = m_processes.first();
@@ -529,8 +524,8 @@
void WebProcessPool::getGPUProcessConnection(WebProcessProxy& webProcessProxy, GPUProcessConnectionParameters&& parameters, Messages::WebProcessProxy::GetGPUProcessConnection::DelayedReply&& reply)
{
- ensureGPUProcess().getGPUProcessConnection(webProcessProxy, parameters, [this, weakThis = makeWeakPtr(*this), parameters, webProcessProxy = makeWeakPtr(webProcessProxy), reply = WTFMove(reply)] (auto& connectionInfo) mutable {
- if (UNLIKELY(!IPC::Connection::identifierIsValid(connectionInfo.identifier()) && webProcessProxy && weakThis)) {
+ ensureGPUProcess().getGPUProcessConnection(webProcessProxy, parameters, [this, protectedThis = makeRef(*this), parameters, webProcessProxy = makeWeakPtr(webProcessProxy), reply = WTFMove(reply)] (auto& connectionInfo) mutable {
+ if (UNLIKELY(!IPC::Connection::identifierIsValid(connectionInfo.identifier()) && webProcessProxy)) {
WEBPROCESSPOOL_RELEASE_LOG_ERROR(Process, "getGPUProcessConnection: Failed first attempt, retrying");
ensureGPUProcess().getGPUProcessConnection(*webProcessProxy, parameters, WTFMove(reply));
return;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
