Changeset 277108 in webkit

Timestamp:

May 6, 2021 12:24:44 PM (3 years ago)

Author:

Russell Epstein

Message:

Apply patch. rdar://problem/77619719

Location:

branches/safari-611.2.7.0-branch/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Platform/IPC/Connection.cpp (modified) (1 diff)

branches/safari-611.2.7.0-branch/Source/WebKit/ChangeLog

@@ +1 @@
+2021-05-06  Russell Epstein  <repstein@apple.com>
+
+        Apply patch. rdar://problem/77619719
+
+    2021-05-06  Chris Dumez  <cdumez@apple.com>
+
+            Crash under IPC::Connection::dispatchMessageToWorkQueueReceiver()
+            <rdar://77576143>
+
+            Reviewed by Alex Christensen.
+
+            When r274565 was merged to the safari-611-branch branch, its `ASSERT(connection.m_incomingMessagesMutex.isHeld())`
+            did not hold there. Unlike trunk, the call-site (Connection::processIncomingMessage(std::unique_ptr<Decoder>)) does
+            not hold the m_incomingMessagesMutex lock on the safari-611-branch branch. This leads to crashes due to lack of
+            synchronization when accessing / modifying the m_incomingMessages Dequeue on the main thread and IPC thread in
+            parallel. To address the issue on the safari-611-branch branch, we now grab the m_incomingMessagesMutex lock before
+            modifying the m_incomingMessages Dequeue in Connection::SyncMessageState::processIncomingMessage().
+
+            No new tests, existing tests were crashing in debug already.
+
+            * Platform/IPC/Connection.cpp:
+            (IPC::Connection::SyncMessageState::processIncomingMessage):
+
 2021-05-03  Russell Epstein  <repstein@apple.com>
 

branches/safari-611.2.7.0-branch/Source/WebKit/Platform/IPC/Connection.cpp

@@ -148 +148 @@
         auto locker = holdLock(m_mutex);
         shouldDispatch = m_didScheduleDispatchMessagesWorkSet.add(&connection).isNewEntry;
-        ASSERT(connection.m_incomingMessagesMutex.isHeld());
+        auto incomingMessagesLocker = holdLock(connection.m_incomingMessagesMutex);
         if (message->shouldMaintainOrderingWithAsyncMessages()) {
             // This sync message should maintain ordering with async messages so we need to process the pending async messages first.