[webkit-changes] [153604] branches/safari-537-branch/Source/WebKit2

Thu, 01 Aug 2013 13:56:11 -0700

Title: [153604] branches/safari-537-branch/Source/WebKit2

Diff

Modified: branches/safari-537-branch/Source/WebKit2/ChangeLog (153603 => 153604)


--- branches/safari-537-branch/Source/WebKit2/ChangeLog	2013-08-01 20:54:29 UTC (rev 153603)
+++ branches/safari-537-branch/Source/WebKit2/ChangeLog	2013-08-01 20:56:42 UTC (rev 153604)
@@ -1,5 +1,32 @@
 2013-08-01  Lucas Forschler  <[email protected]>
 
+        Merge r153488
+
+    2013-07-30  Anders Carlsson  <[email protected]>
+
+            Plug-in process crashes if plug-in is destroyed as a result of sending NPObjectMessageReceiver::Deallocate
+            https://bugs.webkit.org/show_bug.cgi?id=119270
+            <rdar://problem/13368226>
+
+            Reviewed by Darin Adler.
+
+            Normally we use the PluginDestructionProtector RAII object to prevent plug-ins from being destroyed while
+            they're executing code. However, in the case of the NPObjectMessageReceiver::Deallocate message, we can't do this
+            since we don't know the plug-in or connection. 
+
+            Instead, add a counter to Connection that keeps track of whether sendSync is currently called and defer plug-in
+            destruction if it is. (This approach is actually more robust and we should investigate getting rid of the destruction protector).
+
+            * Platform/CoreIPC/Connection.cpp:
+            (CoreIPC::Connection::Connection):
+            (CoreIPC::Connection::sendSyncMessage):
+            * Platform/CoreIPC/Connection.h:
+            (CoreIPC::Connection::inSendSync):
+            * PluginProcess/PluginControllerProxy.cpp:
+            (WebKit::PluginControllerProxy::destroy):
+
+2013-08-01  Lucas Forschler  <[email protected]>
+
         Merge r153482
 
     2013-07-30  Jeff Miller  <[email protected]>

Modified: branches/safari-537-branch/Source/WebKit2/Platform/CoreIPC/Connection.cpp (153603 => 153604)


--- branches/safari-537-branch/Source/WebKit2/Platform/CoreIPC/Connection.cpp	2013-08-01 20:54:29 UTC (rev 153603)
+++ branches/safari-537-branch/Source/WebKit2/Platform/CoreIPC/Connection.cpp	2013-08-01 20:56:42 UTC (rev 153604)
@@ -225,6 +225,7 @@
     , m_isConnected(false)
     , m_connectionQueue(WorkQueue::create("com.apple.CoreIPC.ReceiveQueue"))
     , m_clientRunLoop(clientRunLoop)
+    , m_inSendSyncCount(0)
     , m_inDispatchMessageCount(0)
     , m_inDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount(0)
     , m_didReceiveInvalidMessage(false)
@@ -460,6 +461,8 @@
         m_pendingSyncReplies.append(PendingSyncReply(syncRequestID));
     }
 
+    ++m_inSendSyncCount;
+
     // First send the message.
     sendMessage(encoder, DispatchMessageEvenWhenWaitingForSyncReply);
 
@@ -468,6 +471,8 @@
     RefPtr<Connection> protect(this);
     OwnPtr<MessageDecoder> reply = waitForSyncReply(syncRequestID, timeout, syncSendFlags);
 
+    --m_inSendSyncCount;
+
     // Finally, pop the pending sync reply information.
     {
         MutexLocker locker(m_syncReplyStateMutex);

Modified: branches/safari-537-branch/Source/WebKit2/Platform/CoreIPC/Connection.h (153603 => 153604)


--- branches/safari-537-branch/Source/WebKit2/Platform/CoreIPC/Connection.h	2013-08-01 20:54:29 UTC (rev 153603)
+++ branches/safari-537-branch/Source/WebKit2/Platform/CoreIPC/Connection.h	2013-08-01 20:56:42 UTC (rev 153604)
@@ -184,6 +184,8 @@
     void incrementDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount() { ++m_inDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount; }
     void decrementDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount() { --m_inDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount; }
 
+    bool inSendSync() const { return m_inSendSyncCount; }
+
 private:
     Connection(Identifier, bool isServer, Client*, WebCore::RunLoop* clientRunLoop);
     void platformInitialize(Identifier);
@@ -235,6 +237,7 @@
 
     HashMap<StringReference, std::pair<RefPtr<WorkQueue>, RefPtr<WorkQueueMessageReceiver>>> m_workQueueMessageReceivers;
 
+    unsigned m_inSendSyncCount;
     unsigned m_inDispatchMessageCount;
     unsigned m_inDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount;
     bool m_didReceiveInvalidMessage;

Modified: branches/safari-537-branch/Source/WebKit2/PluginProcess/PluginControllerProxy.cpp (153603 => 153604)


--- branches/safari-537-branch/Source/WebKit2/PluginProcess/PluginControllerProxy.cpp	2013-08-01 20:54:29 UTC (rev 153603)
+++ branches/safari-537-branch/Source/WebKit2/PluginProcess/PluginControllerProxy.cpp	2013-08-01 20:56:42 UTC (rev 153604)
@@ -143,7 +143,8 @@
 {
     ASSERT(m_plugin);
 
-    if (m_pluginDestructionProtectCount) {
+    // FIXME: Consider removing m_pluginDestructionProtectCount and always use inSendSync here.
+    if (m_pluginDestructionProtectCount || m_connection->connection()->inSendSync()) {
         // We have plug-in code on the stack so we can't destroy it right now.
         // Destroy it later.
         m_pluginDestroyTimer.startOneShot(0);

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to