Changeset 209995 in webkit

Timestamp:

Dec 19, 2016 1:27:15 PM (7 years ago)

Author:

andersca@apple.com

Message:

REGRESSION: Crash in com.apple.WebKit:IPC::Connection::platformCanSendOutgoingMessages() const + 0
​https://bugs.webkit.org/show_bug.cgi?id=165817
rdar://problem/29626731

Reviewed by Dan Bernstein.

If the receive right is invalidated before we send the message, the kernel won't be able to create a send right,
and we'll crash due to mach_msg returning MACH_SEND_INVALID_RIGHT.

Fix this by immediately creating a send right, and passing MACH_MSG_TYPE_MOVE_SEND to the attachment constructor.

• WebProcess/WebPage/WebInspector.cpp:

(WebKit::WebInspector::openFrontendConnection):

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/WebPage/WebInspector.cpp (modified) (1 diff)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2016-12-19  Anders Carlsson  <andersca@apple.com>
+
+        REGRESSION: Crash in com.apple.WebKit:IPC::Connection::platformCanSendOutgoingMessages() const + 0
+        https://bugs.webkit.org/show_bug.cgi?id=165817
+        rdar://problem/29626731
+
+        Reviewed by Dan Bernstein.
+
+        If the receive right is invalidated before we send the message, the kernel won't be able to create a send right,
+        and we'll crash due to mach_msg returning MACH_SEND_INVALID_RIGHT.
+        
+        Fix this by immediately creating a send right, and passing MACH_MSG_TYPE_MOVE_SEND to the attachment constructor.
+
+        * WebProcess/WebPage/WebInspector.cpp:
+        (WebKit::WebInspector::openFrontendConnection):
+
 2016-12-18  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebKit2/WebProcess/WebPage/WebInspector.cpp

@@ -80 +80 @@
     mach_port_t listeningPort;
     mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &listeningPort);
+    mach_port_insert_right(mach_task_self(), listeningPort, listeningPort, MACH_MSG_TYPE_MAKE_SEND);
 
     IPC::Connection::Identifier connectionIdentifier(listeningPort);
-    IPC::Attachment connectionClientPort(listeningPort, MACH_MSG_TYPE_MAKE_SEND);
+    IPC::Attachment connectionClientPort(listeningPort, MACH_MSG_TYPE_MOVE_SEND);
+
 #else
     notImplemented();