Changeset 202736 in webkit

Timestamp:

Jul 1, 2016 8:40:39 AM (8 years ago)

Author:

jer.noble@apple.com

Message:

Deadlock inside -[WebCoreNSURLSession dealloc]
​https://bugs.webkit.org/show_bug.cgi?id=159331
<rdar://problem/27122716>

Reviewed by Alex Christensen.

A Function<> object can wrap any callable type, including a C++ lambda.

dispatchFunctionsFromMainThread() holds a lock while iterating over the functions in
functionQueue(), and during ths iteration, the previous callable object is destroyed by
assigning the result of functionQueue().takeFirst(). Because lambdas (and other callables,
like functors) can own objects, destroying this callable can have side effects, and if one
of those side effects is to call callOnMainThread(), this can deadlock.

Move this side-effect-having call outside the locked block by clearing the function object
immediately after calling it.

• wtf/MainThread.cpp:

(WTF::dispatchFunctionsFromMainThread):

Location:

trunk/Source/WTF

Files:

• ChangeLog (modified) (1 diff)
• wtf/MainThread.cpp (modified) (1 diff)

trunk/Source/WTF/ChangeLog

@@ +1 @@
+2016-07-01  Jer Noble  <jer.noble@apple.com>
+
+        Deadlock inside -[WebCoreNSURLSession dealloc]
+        https://bugs.webkit.org/show_bug.cgi?id=159331
+        <rdar://problem/27122716>
+
+        Reviewed by Alex Christensen.
+
+        A Function<> object can wrap any callable type, including a C++ lambda.
+
+        dispatchFunctionsFromMainThread() holds a lock while iterating over the functions in
+        functionQueue(), and during ths iteration, the previous callable object is destroyed by
+        assigning the result of functionQueue().takeFirst(). Because lambdas (and other callables,
+        like functors) can own objects, destroying this callable can have side effects, and if one
+        of those side effects is to call callOnMainThread(), this can deadlock.
+
+        Move this side-effect-having call outside the locked block by clearing the function object
+        immediately after calling it.
+
+        * wtf/MainThread.cpp:
+        (WTF::dispatchFunctionsFromMainThread):
+
 2016-06-29  Jer Noble  <jer.noble@apple.com>
 

trunk/Source/WTF/wtf/MainThread.cpp

@@ -134 +134 @@
         function();
 
+        // Clearing the function can have side effects, so do so outside of the lock above.
+        function = nullptr;
+
         // If we are running accumulated functions for too long so UI may become unresponsive, we need to
         // yield so the user input can be processed. Otherwise user may not be able to even close the window.