Title: [286800] trunk/Source/WebKit
- Revision
- 286800
- Author
- [email protected]
- Date
- 2021-12-09 13:14:04 -0800 (Thu, 09 Dec 2021)
Log Message
[WPE] Crash under WebProcessProxy::setIsInProcessCache when closing web view in debug builds
https://bugs.webkit.org/show_bug.cgi?id=233933
Reviewed by Geoffrey Garen.
The crash would occur because the WebProcessPool destructor would call WebProcessCache::clear()
which would destroy WebProcessCache::CachedProcess objects, causing
WebProcessProxy::setIsInProcessCache(false) to get called. Previously, this call to
setIsInProcessCache() would convert the WeakPtr the WebProcessProxy held to its process pool
into a RefPtr, thus causing the WebProcessPool to get ref'd while in the middle of destruction.
To address the issue, the setIsInProcessCache() setter now takes a WillShutDown flag that gets
set in the CachedProcess destructor and which causes setIsInProcessCache() to return early
right after setting the m_isInProcessCache flag, without trying to send IPC to the WebProcess
or trying to ref the WebProcessPool.
* UIProcess/WebProcessCache.cpp:
(WebKit::WebProcessCache::CachedProcess::~CachedProcess):
* UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::setIsInProcessCache):
* UIProcess/WebProcessProxy.h:
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (286799 => 286800)
--- trunk/Source/WebKit/ChangeLog 2021-12-09 20:55:16 UTC (rev 286799)
+++ trunk/Source/WebKit/ChangeLog 2021-12-09 21:14:04 UTC (rev 286800)
@@ -1,3 +1,27 @@
+2021-12-09 Chris Dumez <[email protected]>
+
+ [WPE] Crash under WebProcessProxy::setIsInProcessCache when closing web view in debug builds
+ https://bugs.webkit.org/show_bug.cgi?id=233933
+
+ Reviewed by Geoffrey Garen.
+
+ The crash would occur because the WebProcessPool destructor would call WebProcessCache::clear()
+ which would destroy WebProcessCache::CachedProcess objects, causing
+ WebProcessProxy::setIsInProcessCache(false) to get called. Previously, this call to
+ setIsInProcessCache() would convert the WeakPtr the WebProcessProxy held to its process pool
+ into a RefPtr, thus causing the WebProcessPool to get ref'd while in the middle of destruction.
+
+ To address the issue, the setIsInProcessCache() setter now takes a WillShutDown flag that gets
+ set in the CachedProcess destructor and which causes setIsInProcessCache() to return early
+ right after setting the m_isInProcessCache flag, without trying to send IPC to the WebProcess
+ or trying to ref the WebProcessPool.
+
+ * UIProcess/WebProcessCache.cpp:
+ (WebKit::WebProcessCache::CachedProcess::~CachedProcess):
+ * UIProcess/WebProcessProxy.cpp:
+ (WebKit::WebProcessProxy::setIsInProcessCache):
+ * UIProcess/WebProcessProxy.h:
+
2021-12-08 BJ Burg <[email protected]>
[Cocoa] Web Inspector: provide a way for _WKInspectorExtension clients to be to notified when an extension tab navigates
Modified: trunk/Source/WebKit/UIProcess/WebProcessCache.cpp (286799 => 286800)
--- trunk/Source/WebKit/UIProcess/WebProcessCache.cpp 2021-12-09 20:55:16 UTC (rev 286799)
+++ trunk/Source/WebKit/UIProcess/WebProcessCache.cpp 2021-12-09 21:14:04 UTC (rev 286800)
@@ -294,7 +294,7 @@
if (isSuspended())
m_process->platformResumeProcess();
#endif
- m_process->setIsInProcessCache(false);
+ m_process->setIsInProcessCache(false, WebProcessProxy::WillShutDown::Yes);
m_process->shutDown();
}
Modified: trunk/Source/WebKit/UIProcess/WebProcessProxy.cpp (286799 => 286800)
--- trunk/Source/WebKit/UIProcess/WebProcessProxy.cpp 2021-12-09 20:55:16 UTC (rev 286799)
+++ trunk/Source/WebKit/UIProcess/WebProcessProxy.cpp 2021-12-09 21:14:04 UTC (rev 286800)
@@ -309,7 +309,7 @@
}
#endif
-void WebProcessProxy::setIsInProcessCache(bool value)
+void WebProcessProxy::setIsInProcessCache(bool value, WillShutDown willShutDown)
{
WEBPROCESSPROXY_RELEASE_LOG(Process, "setIsInProcessCache(%d)", value);
if (value) {
@@ -321,6 +321,11 @@
ASSERT(m_isInProcessCache != value);
m_isInProcessCache = value;
+ // No point in doing anything else if the process is about to shut down.
+ ASSERT(willShutDown == WillShutDown::No || !value);
+ if (willShutDown == WillShutDown::Yes)
+ return;
+
send(Messages::WebProcess::SetIsInProcessCache(m_isInProcessCache), 0);
if (m_isInProcessCache) {
Modified: trunk/Source/WebKit/UIProcess/WebProcessProxy.h (286799 => 286800)
--- trunk/Source/WebKit/UIProcess/WebProcessProxy.h 2021-12-09 20:55:16 UTC (rev 286799)
+++ trunk/Source/WebKit/UIProcess/WebProcessProxy.h 2021-12-09 21:14:04 UTC (rev 286800)
@@ -156,7 +156,9 @@
bool isMatchingRegistrableDomain(const WebCore::RegistrableDomain& domain) const { return m_registrableDomain ? *m_registrableDomain == domain : false; }
WebCore::RegistrableDomain registrableDomain() const { return m_registrableDomain.value_or(WebCore::RegistrableDomain { }); }
const std::optional<WebCore::RegistrableDomain>& optionalRegistrableDomain() const { return m_registrableDomain; }
- void setIsInProcessCache(bool);
+
+ enum class WillShutDown : bool { No, Yes };
+ void setIsInProcessCache(bool, WillShutDown = WillShutDown::No);
bool isInProcessCache() const { return m_isInProcessCache; }
void enableServiceWorkers(const UserContentControllerIdentifier&);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
