Changeset 256666 in webkit

Timestamp:

Feb 14, 2020 7:01:16 PM (4 years ago)

Author:

Russell Epstein

Message:

Cherry-pick r256187. rdar://problem/59446994

Crash under WebProcessProxy::shouldSendPendingMessage()
​https://bugs.webkit.org/show_bug.cgi?id=207464
<rdar://problem/59293825>

Reviewed by Alex Christensen.

I suspect the WebProcessProxy object is getting destroyed as we are iterating over the
pending messages in AuxiliaryProcessProxy::didFinishLaunching(), thus crashing when
calling WebProcessProxy::shouldSendPendingMessage() inside the loop. As a speculative
fix, protect |this| at the beginning of WebProcessProxy::didFinishLaunching().

• UIProcess/WebProcessProxy.cpp: (WebKit::WebProcessProxy::didFinishLaunching):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@256187 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-609-branch/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/WebProcessProxy.cpp (modified) (1 diff)

branches/safari-609-branch/Source/WebKit/ChangeLog

@@ +1 @@
+2020-02-14  Russell Epstein  <repstein@apple.com>
+
+        Cherry-pick r256187. rdar://problem/59446994
+
+    Crash under WebProcessProxy::shouldSendPendingMessage()
+    https://bugs.webkit.org/show_bug.cgi?id=207464
+    <rdar://problem/59293825>
+    
+    Reviewed by Alex Christensen.
+    
+    I suspect the WebProcessProxy object is getting destroyed as we are iterating over the
+    pending messages in AuxiliaryProcessProxy::didFinishLaunching(), thus crashing when
+    calling WebProcessProxy::shouldSendPendingMessage() inside the loop. As a speculative
+    fix, protect |this| at the beginning of WebProcessProxy::didFinishLaunching().
+    
+    * UIProcess/WebProcessProxy.cpp:
+    (WebKit::WebProcessProxy::didFinishLaunching):
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@256187 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2020-02-10  Chris Dumez  <cdumez@apple.com>
+
+            Crash under WebProcessProxy::shouldSendPendingMessage()
+            https://bugs.webkit.org/show_bug.cgi?id=207464
+            <rdar://problem/59293825>
+
+            Reviewed by Alex Christensen.
+
+            I suspect the WebProcessProxy object is getting destroyed as we are iterating over the
+            pending messages in AuxiliaryProcessProxy::didFinishLaunching(), thus crashing when
+            calling WebProcessProxy::shouldSendPendingMessage() inside the loop. As a speculative
+            fix, protect |this| at the beginning of WebProcessProxy::didFinishLaunching().
+
+            * UIProcess/WebProcessProxy.cpp:
+            (WebKit::WebProcessProxy::didFinishLaunching):
+
 2020-02-13  Russell Epstein  <repstein@apple.com>
 

branches/safari-609-branch/Source/WebKit/UIProcess/WebProcessProxy.cpp

@@ -885 +885 @@
     RELEASE_ASSERT(isMainThreadOrCheckDisabled());
 
+    auto protectedThis = makeRef(*this);
     AuxiliaryProcessProxy::didFinishLaunching(launcher, connectionIdentifier);