Changeset 267482 in webkit

Timestamp:

Sep 23, 2020, 9:41:07 AM (6 years ago)

Author:

Alan Coon

Message:

Cherry-pick r267412. rdar://problem/69439628

Crashtracer inside PDFPlugin::createScrollbar.
<rdar://problem/69256031> and ​https://bugs.webkit.org/show_bug.cgi?id=216810

Reviewed by Tim Horton.

To quote Tim from r264945:
No new tests; timing is such that I can't reproduce without inserting
intentional delays into the main thread hops, which is further than
I'm willing to go for a test.

This is a speculative fix due to the aforementioned reproducibility issue.

• WebProcess/Plugins/PDF/PDFPlugin.mm: (WebKit::PDFPlugin::installPDFDocument): With all the past fixes in place, its apparent the plug-in HAS been torn down, and it's somewhat common to bypass the other "hasBeenDestroyed" checks. So put an explicit check here followed by an explicit release assert.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@267412 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-610.2.6.1-branch/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/Plugins/PDF/PDFPlugin.mm (modified) (1 diff)

branches/safari-610.2.6.1-branch/Source/WebKit/ChangeLog

@@ +1 @@
+2020-09-23  Russell Epstein  <repstein@apple.com>
+
+        Cherry-pick r267412. rdar://problem/69439628
+
+    Crashtracer inside PDFPlugin::createScrollbar.
+    <rdar://problem/69256031> and https://bugs.webkit.org/show_bug.cgi?id=216810
+    
+    Reviewed by Tim Horton.
+    
+    To quote Tim from r264945:
+    No new tests; timing is such that I can't reproduce without inserting
+    intentional delays into the main thread hops, which is further than
+    I'm willing to go for a test.
+    
+    This is a speculative fix due to the aforementioned reproducibility issue.
+    
+    * WebProcess/Plugins/PDF/PDFPlugin.mm:
+    (WebKit::PDFPlugin::installPDFDocument): With all the past fixes in place, its apparent
+      the plug-in HAS been torn down, and it's somewhat common to bypass the other "hasBeenDestroyed"
+      checks. So put an explicit check here followed by an explicit release assert.
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@267412 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2020-09-22  Brady Eidson  <beidson@apple.com>
+
+            Crashtracer inside PDFPlugin::createScrollbar.
+            <rdar://problem/69256031> and https://bugs.webkit.org/show_bug.cgi?id=216810
+
+            Reviewed by Tim Horton.
+
+            To quote Tim from r264945:
+            No new tests; timing is such that I can't reproduce without inserting
+            intentional delays into the main thread hops, which is further than
+            I'm willing to go for a test.
+
+            This is a speculative fix due to the aforementioned reproducibility issue.
+
+            * WebProcess/Plugins/PDF/PDFPlugin.mm:
+            (WebKit::PDFPlugin::installPDFDocument): With all the past fixes in place, its apparent
+              the plug-in HAS been torn down, and it's somewhat common to bypass the other "hasBeenDestroyed"
+              checks. So put an explicit check here followed by an explicit release assert.
+
 2020-09-18  Alan Coon  <alancoon@apple.com>
 

branches/safari-610.2.6.1-branch/Source/WebKit/WebProcess/Plugins/PDF/PDFPlugin.mm

@@ -1572 +1572 @@
     LOG(IncrementalPDF, "Installing PDF document");
 
+    if (m_hasBeenDestroyed)
+        return;
+
+    // If we haven't been destroyed yet, there must still be a PluginController
+    RELEASE_ASSERT(controller());
+
 #if HAVE(INCREMENTAL_PDF_APIS)
     maybeClearHighLatencyDataProviderFlag();