Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: cf745fa2e33c21fb171f09a91e16159913675d4e
https://github.com/WebKit/WebKit/commit/cf745fa2e33c21fb171f09a91e16159913675d4e
Author: Chris Dumez <[email protected]>
Date: 2024-02-07 (Wed, 07 Feb 2024)
Changed paths:
M Source/WebCore/dom/MessagePort.cpp
Log Message:
-----------
Intermittent crash in
imported/w3c/web-platform-tests/workers/semantics/multiple-workers/exposure.any.html
https://bugs.webkit.org/show_bug.cgi?id=268802
rdar://122365041
Reviewed by Darin Adler.
In MessagePort::notifyMessageAvailable(), we were looking up the script
execution
context identifier from the message port identifier in a first HashMap. Then we
would dispatch an asynchronous task to this script execution context's context
thread. In that task, we would look up the MessagePort from its identifier in
a second map.
Because the 2 HashMap lookups would happens at different times, releasing the
lock
in between, we could end up in a case where: by the time the async task runs on
the context thread, a new MessagePort has been added to the map, with the same
identifier (sadly this can happen because MessagePorts can be sent across
threads).
As a result, the script execution context of this new port may not match the
original
context we dispatched too earlier. In the context of the crash, we would get:
- We're dealing with a worker MessagePort, so we dispatch to that worker thread
- On the worker thread, we look up the MessagePort and look up its script
execution
context. We expect its context to be a WorkerGlobalScope. However, it ends up
being
a Document (which we try to ref on a worker thread) since the MessagePort we
looked
up is a main thread MessagePort.
To address the issue, we now look up the MessagePort at the same time as the
context
lookup, to make sure that they are consistent with each other. Then we capture
this
port in the lambda we run on the scriptExecutionContext's context thread.
* Source/WebCore/dom/MessagePort.cpp:
(WebCore::MessagePort::notifyMessageAvailable):
Canonical link: https://commits.webkit.org/274218@main
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
