Changeset 202821 in webkit

Timestamp:

Jul 5, 2016 11:04:28 AM (8 years ago)

Author:

beidson@apple.com

Message:

TransactionOperations can get destroyed on the wrong thread.
​https://bugs.webkit.org/show_bug.cgi?id=159103

Reviewed by Alex Christensen.

No new tests (Very racy, not feasible to write a dedicated test for, caught on bots occasionally as-is).

• Modules/indexeddb/IDBActiveDOMObject.h:

(WebCore::IDBActiveDOMObject::callFunctionOnOriginThread):

• Modules/indexeddb/client/IDBConnectionProxy.cpp:

(WebCore::IDBClient::IDBConnectionProxy::completeOperation): Pass the last ref to the operation to its

origin thread to be deleted there.

• Modules/indexeddb/client/TransactionOperation.h:

(WebCore::IDBClient::TransactionOperation::performCompleteOnOriginThread):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/indexeddb/IDBActiveDOMObject.h (modified) (1 diff)
• Modules/indexeddb/client/IDBConnectionProxy.cpp (modified) (1 diff)
• Modules/indexeddb/client/TransactionOperation.h (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-07-05  Brady Eidson  <beidson@apple.com>
+
+        TransactionOperations can get destroyed on the wrong thread.
+        https://bugs.webkit.org/show_bug.cgi?id=159103
+
+        Reviewed by Alex Christensen.
+
+        No new tests (Very racy, not feasible to write a dedicated test for, caught on bots occasionally as-is).
+
+        * Modules/indexeddb/IDBActiveDOMObject.h:
+        (WebCore::IDBActiveDOMObject::callFunctionOnOriginThread):
+        
+        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
+        (WebCore::IDBClient::IDBConnectionProxy::completeOperation): Pass the last ref to the operation to its
+          origin thread to be deleted there.
+        
+        * Modules/indexeddb/client/TransactionOperation.h:
+        (WebCore::IDBClient::TransactionOperation::performCompleteOnOriginThread):
+
 2016-07-05  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebCore/Modules/indexeddb/IDBActiveDOMObject.h

@@ -64 +64 @@
     }
 
+    void callFunctionOnOriginThread(Function<void ()>&& function)
+    {
+        if (originThreadID() == currentThread()) {
+            function();
+            return;
+        }
+
+        Locker<Lock> lock(m_scriptExecutionContextLock);
+
+        ScriptExecutionContext* context = scriptExecutionContext();
+        if (!context)
+            return;
+
+        context->postTask(WTFMove(function));
+    }
+
 protected:
     IDBActiveDOMObject(ScriptExecutionContext* context)

trunk/Source/WebCore/Modules/indexeddb/client/IDBConnectionProxy.cpp

@@ -224 +224 @@
         return;
 
-    operation->performCompleteOnOriginThread(resultData);
+    operation->performCompleteOnOriginThread(resultData, WTFMove(operation));
 }
 

trunk/Source/WebCore/Modules/indexeddb/client/TransactionOperation.h

@@ -63 +63 @@
     }
 
-    void performCompleteOnOriginThread(const IDBResultData& data)
+    void performCompleteOnOriginThread(const IDBResultData& data, RefPtr<TransactionOperation>&& lastRef)
     {
         ASSERT(isMainThread());
@@ -69 +69 @@
         if (m_originThreadID == currentThread())
             completed(data);
-        else
+        else {
             m_transaction->performCallbackOnOriginThread(*this, &TransactionOperation::completed, data);
+            m_transaction->callFunctionOnOriginThread([lastRef = WTFMove(lastRef)]() {
+            });
+        }
     }