Changeset 246174 in webkit

Timestamp:

Jun 6, 2019 4:00:05 PM (5 years ago)

Author:

ggaren@apple.com

Message:

Crash using WKHTTPCookieStore when you use WKWebView and UIWebView in the same app
​https://bugs.webkit.org/show_bug.cgi?id=198622

Reviewed by Chris Dumez.

Today in a WWDC lab, I saw some crash reports from an app that mixed
WKWebView and UIWebView. The proximate cause of the crash is that
WKHTTPCookieStore queues a callOnMainThread function, and then
UIWebView dequeues it on the WebThread.

No test because this crash depends on mixing WKWebView and UIWebView and
getting (un)lucky on the timing.

• UIProcess/API/APIHTTPCookieStore.cpp:

(API::HTTPCookieStore::cookies):
(API::HTTPCookieStore::setCookies):
(API::HTTPCookieStore::deleteCookie): Avoid using callOnMainThread
becuase it is prohibited in the UI process.

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/API/APIHTTPCookieStore.cpp (modified) (3 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-06-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Crash using WKHTTPCookieStore when you use WKWebView and UIWebView in the same app
+        https://bugs.webkit.org/show_bug.cgi?id=198622
+
+        Reviewed by Chris Dumez.
+
+        Today in a WWDC lab, I saw some crash reports from an app that mixed
+        WKWebView and UIWebView. The proximate cause of the crash is that
+        WKHTTPCookieStore queues a callOnMainThread function, and then
+        UIWebView dequeues it on the WebThread.
+
+        No test because this crash depends on mixing WKWebView and UIWebView and
+        getting (un)lucky on the timing.
+
+        * UIProcess/API/APIHTTPCookieStore.cpp:
+        (API::HTTPCookieStore::cookies):
+        (API::HTTPCookieStore::setCookies):
+        (API::HTTPCookieStore::deleteCookie): Avoid using callOnMainThread
+        becuase it is prohibited in the UI process.
+
 2019-06-06  Antoine Quint  <graouts@apple.com>
 

trunk/Source/WebKit/UIProcess/API/APIHTTPCookieStore.cpp

@@ -63 +63 @@
         allCookies.appendVector(m_owningDataStore->pendingCookies());
 
-        callOnMainThread([completionHandler = WTFMove(completionHandler), allCookies] () mutable {
+        RunLoop::main().dispatch([completionHandler = WTFMove(completionHandler), allCookies] () mutable {
             completionHandler(allCookies);
         });
@@ -87 +87 @@
         }
 
-        callOnMainThread(WTFMove(completionHandler));
+        RunLoop::main().dispatch(WTFMove(completionHandler));
         return;
     }
@@ -106 +106 @@
             m_owningDataStore->removePendingCookie(cookie);
 
-        callOnMainThread([completionHandler = WTFMove(completionHandler)] () mutable {
+        RunLoop::main().dispatch([completionHandler = WTFMove(completionHandler)] () mutable {
             completionHandler();
         });