Changeset 232157 in webkit

Timestamp:

May 24, 2018, 12:13:28 PM (8 years ago)

Author:

pvollan@apple.com

Message:

Crash under WebKit::PluginProxy::destroy()
​https://bugs.webkit.org/show_bug.cgi?id=185841
<rdar://problem/39936896>

Reviewed by Brent Fulgham.

A release assert in Connection::sencSync is failing since scripts are not allowed in this context,
and the WebKit process is allowed to process incoming messages while waiting for the sync reply.
In this context, scripts are disallowed in the method Element::addShadowRoot. To make sure the
WebContent process will not wait indefinitely for a reply from the Plugin process, use a timeout
of 1 second when sending the message.

• WebProcess/Plugins/PluginProxy.cpp:

(WebKit::PluginProxy::destroy):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/Plugins/PluginProxy.cpp (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2018-05-24  Per Arne Vollan  <pvollan@apple.com>
+
+        Crash under WebKit::PluginProxy::destroy()
+        https://bugs.webkit.org/show_bug.cgi?id=185841
+        <rdar://problem/39936896>
+
+        Reviewed by Brent Fulgham.
+
+        A release assert in Connection::sencSync is failing since scripts are not allowed in this context,
+        and the WebKit process is allowed to process incoming messages while waiting for the sync reply.
+        In this context, scripts are disallowed in the method Element::addShadowRoot. To make sure the
+        WebContent process will not wait indefinitely for a reply from the Plugin process, use a timeout
+        of 1 second when sending the message.
+
+        * WebProcess/Plugins/PluginProxy.cpp:
+        (WebKit::PluginProxy::destroy):
+
 2018-05-24  Carlos Garcia Campos  <cgarcia@igalia.com>
 

trunk/Source/WebKit/WebProcess/Plugins/PluginProxy.cpp

@@ -197 +197 @@
         return;
 
-    m_connection->connection()->sendSync(Messages::WebProcessConnection::DestroyPlugin(m_pluginInstanceID, m_waitingOnAsynchronousInitialization), Messages::WebProcessConnection::DestroyPlugin::Reply(), 0);
+    // Although this message is sent synchronously, the Plugin process replies immediately (before performing any tasks) so this is only waiting for
+    // confirmation that the Plugin process received the DestroyPlugin message.
+    m_connection->connection()->sendSync(Messages::WebProcessConnection::DestroyPlugin(m_pluginInstanceID, m_waitingOnAsynchronousInitialization), Messages::WebProcessConnection::DestroyPlugin::Reply(), 0, 1_s, IPC::SendSyncOption::DoNotProcessIncomingMessagesWhenWaitingForSyncReply);
     m_connection->removePluginProxy(this);
 }