Changeset 248121 in webkit

Timestamp:

Aug 1, 2019 12:53:19 PM (5 years ago)

Author:

Chris Dumez

Message:

Crash under WebProcessProxy::didBecomeUnresponsive()
​https://bugs.webkit.org/show_bug.cgi?id=200346
<rdar://problem/53795984>

Reviewed by Geoffrey Garen.

Make sure the BackgroundProcessResponsivenessTimer / ResponsivenessTimer ref their client
while they call mayBecomeUnresponsive() / willChangeIsResponsive() / didChangeIsResponsive()
/ didBecomeUnresponsive() on their client, in case calling one of these ends up destroying
the client.

• UIProcess/BackgroundProcessResponsivenessTimer.cpp:

(WebKit::BackgroundProcessResponsivenessTimer::setResponsive):

• UIProcess/ResponsivenessTimer.cpp:

(WebKit::ResponsivenessTimer::timerFired):

• UIProcess/ResponsivenessTimer.h:
• UIProcess/WebProcessProxy.h:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/BackgroundProcessResponsivenessTimer.cpp (modified) (1 diff)
• UIProcess/ResponsivenessTimer.cpp (modified) (2 diffs)
• UIProcess/ResponsivenessTimer.h (modified) (1 diff)
• UIProcess/WebProcessProxy.h (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-08-01  Chris Dumez  <cdumez@apple.com>
+
+        Crash under WebProcessProxy::didBecomeUnresponsive()
+        https://bugs.webkit.org/show_bug.cgi?id=200346
+        <rdar://problem/53795984>
+
+        Reviewed by Geoffrey Garen.
+
+        Make sure the BackgroundProcessResponsivenessTimer / ResponsivenessTimer ref their client
+        while they call mayBecomeUnresponsive() / willChangeIsResponsive() / didChangeIsResponsive()
+        / didBecomeUnresponsive() on their client, in case calling one of these ends up destroying
+        the client.
+
+        * UIProcess/BackgroundProcessResponsivenessTimer.cpp:
+        (WebKit::BackgroundProcessResponsivenessTimer::setResponsive):
+        * UIProcess/ResponsivenessTimer.cpp:
+        (WebKit::ResponsivenessTimer::timerFired):
+        * UIProcess/ResponsivenessTimer.h:
+        * UIProcess/WebProcessProxy.h:
+
 2019-08-01  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebKit/UIProcess/BackgroundProcessResponsivenessTimer.cpp

@@ -117 +117 @@
         return;
 
+    auto protectedClient = makeRef(client());
+
     client().willChangeIsResponsive();
     m_isResponsive = isResponsive;

trunk/Source/WebKit/UIProcess/ResponsivenessTimer.cpp

@@ -69 +69 @@
         return;
 
+    auto protectedClient = makeRef(m_client);
+
     if (!m_client.mayBecomeUnresponsive()) {
         m_waitingForTimer = true;
@@ -114 +116 @@
 {
     if (!m_isResponsive) {
+        auto protectedClient = makeRef(m_client);
+
         // We got a life sign from the web process.
         m_client.willChangeIsResponsive();

trunk/Source/WebKit/UIProcess/ResponsivenessTimer.h

@@ -43 +43 @@
 
         virtual bool mayBecomeUnresponsive() = 0;
+
+        virtual void ref() = 0;
+        virtual void deref() = 0;
     };
 

trunk/Source/WebKit/UIProcess/WebProcessProxy.h

@@ -309 +309 @@
     void webPageMediaStateDidChange(WebPageProxy&);
 
+    void ref() final { ThreadSafeRefCounted::ref(); }
+    void deref() final { ThreadSafeRefCounted::deref(); }
+
 protected:
     static WebCore::PageIdentifier generatePageID();