Changeset 74303 in webkit

Timestamp:

Dec 17, 2010 5:07:25 PM (13 years ago)

Author:

andersca@apple.com

Message:

2010-12-17 Anders Carlsson <​andersca@apple.com>

Reviewed by Sam Weinig.

Resizing a WKView while loading a page can leave the page at a size that doesn't match the window
​https://bugs.webkit.org/show_bug.cgi?id=51282
<rdar://problem/8133142>

Fix a race condition in waitForMessage. If we time out on the wait condition, we would keep the
m_waitForMessageMutex mutex unlocked for a brief period of time before taking the lock again and
then removing the messageID/destinationID pair from the hash map. Under some circumstances, the
connection queue would update the hash map right before we removed it, leading to a lost message.

• Platform/CoreIPC/Connection.cpp: (CoreIPC::Connection::waitForMessage):

Location:

trunk/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• Platform/CoreIPC/Connection.cpp (modified) (2 diffs)

trunk/WebKit2/ChangeLog

@@ +1 @@
+2010-12-17  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Resizing a WKView while loading a page can leave the page at a size that doesn't match the window
+        https://bugs.webkit.org/show_bug.cgi?id=51282
+        <rdar://problem/8133142>
+
+        Fix a race condition in waitForMessage. If we time out on the wait condition, we would keep the
+        m_waitForMessageMutex mutex unlocked for a brief period of time before taking the lock again and
+        then removing the messageID/destinationID pair from the hash map. Under some circumstances, the
+        connection queue would update the hash map right before we removed it, leading to a lost message.
+        
+        * Platform/CoreIPC/Connection.cpp:
+        (CoreIPC::Connection::waitForMessage):
+
 2010-12-17  Anders Carlsson  <andersca@apple.com>
 

trunk/WebKit2/Platform/CoreIPC/Connection.cpp

@@ -141 +141 @@
     }
     
-    bool timedOut = false;
-    
     // Now wait for it to be set.
-    while (!timedOut) {
+    while (true) {
         MutexLocker locker(m_waitForMessageMutex);
 
@@ -155 +153 @@
         }
         
-        // We didn't find it, keep waiting.
-        timedOut = !m_waitForMessageCondition.timedWait(m_waitForMessageMutex, absoluteTime);
-    }
-
-    // We timed out, now remove the pending wait.
-    {
-        MutexLocker locker(m_waitForMessageMutex);
-        m_waitForMessageMap.remove(messageAndDestination);
+        // Now we wait.
+        if (!m_waitForMessageCondition.timedWait(m_waitForMessageMutex, absoluteTime)) {
+            // We timed out, now remove the pending wait.
+            m_waitForMessageMap.remove(messageAndDestination);
+
+            break;
+        }
     }