Changeset 248182 in webkit

Timestamp:

Aug 2, 2019 2:32:09 PM (5 years ago)

Author:

Fujii Hironori

Message:

[Curl] Crash while destructing a URL in ~SocketStreamHandle due to data race
​https://bugs.webkit.org/show_bug.cgi?id=200378

Reviewed by Ross Kirsling.

URL::isolatedCopy() is called in the worker thread. URL is using a
thread-unsafe ref-counter. It should be called in the main thread.

Covered by existing tests.

• platform/network/curl/SocketStreamHandleImpl.h:
• platform/network/curl/SocketStreamHandleImplCurl.cpp:

(WebCore::SocketStreamHandleImpl::SocketStreamHandleImpl): Call URL::isolatedCopy() in the main thread.
(WebCore::SocketStreamHandleImpl::threadEntryPoint): Added a URL argument.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/network/curl/SocketStreamHandleImpl.h (modified) (1 diff)
• platform/network/curl/SocketStreamHandleImplCurl.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-08-02  Fujii Hironori  <Hironori.Fujii@sony.com>
+
+        [Curl] Crash while destructing a URL in ~SocketStreamHandle due to data race
+        https://bugs.webkit.org/show_bug.cgi?id=200378
+
+        Reviewed by Ross Kirsling.
+
+        URL::isolatedCopy() is called in the worker thread. URL is using a
+        thread-unsafe ref-counter. It should be called in the main thread.
+
+        Covered by existing tests.
+
+        * platform/network/curl/SocketStreamHandleImpl.h:
+        * platform/network/curl/SocketStreamHandleImplCurl.cpp:
+        (WebCore::SocketStreamHandleImpl::SocketStreamHandleImpl): Call URL::isolatedCopy() in the main thread.
+        (WebCore::SocketStreamHandleImpl::threadEntryPoint): Added a URL argument.
+
 2019-08-02  Sihui Liu  <sihui_liu@apple.com>
 

trunk/Source/WebCore/platform/network/curl/SocketStreamHandleImpl.h

@@ -65 +65 @@
     bool sendPendingData();
 
-    void threadEntryPoint();
+    void threadEntryPoint(const URL&);
     void handleError(CURLcode);
     void stopThread();

trunk/Source/WebCore/platform/network/curl/SocketStreamHandleImplCurl.cpp

@@ -58 +58 @@
         CurlContext::singleton().sslHandle().setIgnoreSSLErrors(true);
 
-    m_workerThread = Thread::create("WebSocket thread", [this, protectedThis = makeRef(*this)] {
-        threadEntryPoint();
+    m_workerThread = Thread::create("WebSocket thread", [this, protectedThis = makeRef(*this), url = url.isolatedCopy()] {
+        threadEntryPoint(url);
     });
 }
@@ -105 +105 @@
 }
 
-void SocketStreamHandleImpl::threadEntryPoint()
+void SocketStreamHandleImpl::threadEntryPoint(const URL& url)
 {
     ASSERT(!isMainThread());
 
-    CurlSocketHandle socket { m_url.isolatedCopy(), [this](CURLcode errorCode) {
+    CurlSocketHandle socket { url, [this](CURLcode errorCode) {
         handleError(errorCode);
     }};