Changeset 260544 in webkit

Timestamp:

Apr 22, 2020 5:04:26 PM (4 years ago)

Author:

Chris Dumez

Message:

[iOS] Crash on RunningBoard process assertion invalidation
​https://bugs.webkit.org/show_bug.cgi?id=210873
<rdar://problem/62194917>

Reviewed by Darin Adler.

• UIProcess/ios/ProcessAssertionIOS.mm:

(-[WKRBSAssertionDelegate assertion:didInvalidateWithError:]):
Capture a weak pointer to self and make sure we only access the invalidation handler on
the main thread if |self| is still alive.

(WebKit::ProcessAssertion::~ProcessAssertion):
Null out the WKRBSAssertionDelegate's observer in the ProcessAssertion destructor, to
make sure processAssertionWasInvalidated() cannot get called after the ProcessAssertion
has been destroyed.

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/ios/ProcessAssertionIOS.mm (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2020-04-22  Chris Dumez  <cdumez@apple.com>
+
+        [iOS] Crash on RunningBoard process assertion invalidation
+        https://bugs.webkit.org/show_bug.cgi?id=210873
+        <rdar://problem/62194917>
+
+        Reviewed by Darin Adler.
+
+        * UIProcess/ios/ProcessAssertionIOS.mm:
+        (-[WKRBSAssertionDelegate assertion:didInvalidateWithError:]):
+        Capture a weak pointer to self and make sure we only access the invalidation handler on
+        the main thread if |self| is still alive.
+
+        (WebKit::ProcessAssertion::~ProcessAssertion):
+        Null out the WKRBSAssertionDelegate's observer in the ProcessAssertion destructor, to
+        make sure processAssertionWasInvalidated() cannot get called after the ProcessAssertion
+        has been destroyed.
+
 2020-04-22  David Kilzer  <ddkilzer@apple.com>
 

trunk/Source/WebKit/UIProcess/ios/ProcessAssertionIOS.mm

@@ -287 +287 @@
 {
     RELEASE_LOG(ProcessSuspension, "%p - WKRBSAssertionDelegate: assertion was invalidated, error: %{public}@", error, self);
+
+    __weak WKRBSAssertionDelegate *weakSelf = self;
     dispatch_async(dispatch_get_main_queue(), ^{
-        if (_invalidationCallback)
-            _invalidationCallback();
+        WKRBSAssertionDelegate *strongSelf = weakSelf;
+        if (strongSelf && strongSelf.invalidationCallback)
+            strongSelf.invalidationCallback();
     });
 }
@@ -420 +423 @@
 
     if (m_rbsAssertion) {
+        m_delegate.get().invalidationCallback = nil;
+        m_delegate = nil;
+
         [m_rbsAssertion removeObserver:m_delegate.get()];
         [m_rbsAssertion invalidate];