Changeset 77874 in webkit


Ignore:
Timestamp:
Feb 7, 2011 5:44:49 PM (13 years ago)
Author:
andersca@apple.com
Message:

2011-02-07 Anders Carlsson <​andersca@apple.com>

Reviewed by Sam Weinig.

Crash in web process after the connection had been closed
​https://bugs.webkit.org/show_bug.cgi?id=51115
<rdar://problem/8964255>

Remove didCloseOnConnectionWorkQueue from Connection::Client and add
Connection::setDidCloseOnConnectionWorkQueueCallback which takes a static
function, eliminating the race condition in connectionDidClose where m_client could be
nulled out in the client thread right before we try to dereference it.

  • Platform/CoreIPC/Connection.cpp: (CoreIPC::Connection::Connection): Initialize m_didCloseOnConnectionWorkQueueCallback.

(CoreIPC::Connection::setDidCloseOnConnectionWorkQueueCallback):
Update m_didCloseOnConnectionWorkQueueCallback.

(CoreIPC::Connection::connectionDidClose):
Call m_didCloseOnConnectionWorkQueueCallback.

  • Platform/WorkQueue.h: Make WorkQueue noncopyable.
  • PluginProcess/PluginProcess.cpp: (WebKit::PluginProcess::initializeConnection): Call setDidCloseOnConnectionWorkQueueCallback.
  • Shared/ChildProcess.cpp: (WebKit::ChildProcess::didCloseOnConnectionWorkQueue):
  • Shared/ChildProcess.h: didCloseOnConnectionWorkQueue is now a static member function.
  • WebProcess/WebProcess.cpp: (WebKit::WebProcess::initialize): Call setDidCloseOnConnectionWorkQueueCallback.
Location:
trunk/Source/WebKit2
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebKit2/ChangeLog

    r77870 r77874  
     12011-02-07  Anders Carlsson  <andersca@apple.com>
     2
     3        Reviewed by Sam Weinig.
     4
     5        Crash in web process after the connection had been closed
     6        https://bugs.webkit.org/show_bug.cgi?id=51115
     7        <rdar://problem/8964255>
     8
     9        Remove didCloseOnConnectionWorkQueue from Connection::Client and add
     10        Connection::setDidCloseOnConnectionWorkQueueCallback which takes a static
     11        function, eliminating the race condition in connectionDidClose where m_client could be
     12        nulled out in the client thread right before we try to dereference it.
     13
     14        * Platform/CoreIPC/Connection.cpp:
     15        (CoreIPC::Connection::Connection):
     16        Initialize m_didCloseOnConnectionWorkQueueCallback.
     17
     18        (CoreIPC::Connection::setDidCloseOnConnectionWorkQueueCallback):
     19        Update m_didCloseOnConnectionWorkQueueCallback.
     20
     21        (CoreIPC::Connection::connectionDidClose):
     22        Call m_didCloseOnConnectionWorkQueueCallback.
     23
     24        * Platform/WorkQueue.h:
     25        Make WorkQueue noncopyable.
     26
     27        * PluginProcess/PluginProcess.cpp:
     28        (WebKit::PluginProcess::initializeConnection):
     29        Call setDidCloseOnConnectionWorkQueueCallback.
     30
     31        * Shared/ChildProcess.cpp:
     32        (WebKit::ChildProcess::didCloseOnConnectionWorkQueue):
     33        * Shared/ChildProcess.h:
     34        didCloseOnConnectionWorkQueue is now a static member function.
     35
     36        * WebProcess/WebProcess.cpp:
     37        (WebKit::WebProcess::initialize):
     38        Call setDidCloseOnConnectionWorkQueueCallback.
     39
    1402011-02-07  Enrica Casucci  <enrica@apple.com>
    241

  • trunk/Source/WebKit2/Platform/CoreIPC/Connection.cpp

    r77258 r77874  
    5050    , m_isServer(isServer)
    5151    , m_syncRequestID(0)
     52    , m_didCloseOnConnectionWorkQueueCallback(0)
    5253    , m_isConnected(false)
    5354    , m_connectionQueue("com.apple.CoreIPC.ReceiveQueue")
    … …  
    6768
    6869    m_connectionQueue.invalidate();
     70}
     71
     72void Connection::setDidCloseOnConnectionWorkQueueCallback(DidCloseOnConnectionWorkQueueCallback callback)
     73{
     74    ASSERT(!m_isConnected);
     75
     76    m_didCloseOnConnectionWorkQueueCallback = callback;   
    6977}
    7078
    … …  
    335343    }
    336344
    337     m_client->didCloseOnConnectionWorkQueue(&m_connectionQueue, this);
     345    if (m_didCloseOnConnectionWorkQueueCallback)
     346        m_didCloseOnConnectionWorkQueueCallback(m_connectionQueue, this);
    338347
    339348    m_clientRunLoop->scheduleWork(WorkItem::create(this, &Connection::dispatchConnectionDidClose));

  • trunk/Source/WebKit2/Platform/CoreIPC/Connection.h

    r76507 r77874  
    8686        virtual void didClose(Connection*) = 0;
    8787        virtual void didReceiveInvalidMessage(Connection*, MessageID) = 0;
    88 
    89         // Called on the connection work queue when the connection is closed, before
    90         // didCall is called on the client thread.
    91         virtual void didCloseOnConnectionWorkQueue(WorkQueue*, Connection*) { }
    9288    };
    9389
    … …  
    113109#endif
    114110
     111    // The set callback will be called on the connection work queue when the connection is closed,
     112    // before didCall is called on the client thread. Must be called before the connection is opened.
     113    // In the future we might want a more generic way to handle sync or async messages directly
     114    // on the work queue, for example if we want to handle them on some other thread we could avoid
     115    // handling the message on the client thread first.
     116    typedef void (*DidCloseOnConnectionWorkQueueCallback)(WorkQueue&, Connection*);
     117    void setDidCloseOnConnectionWorkQueueCallback(DidCloseOnConnectionWorkQueueCallback callback);
     118                                               
    115119    bool open();
    116120    void invalidate();
    … …  
    195199    uint64_t m_syncRequestID;
    196200
     201    DidCloseOnConnectionWorkQueueCallback m_didCloseOnConnectionWorkQueueCallback;
     202
    197203    bool m_isConnected;
    198204    WorkQueue m_connectionQueue;

  • trunk/Source/WebKit2/Platform/WorkQueue.h

    r76507 r77874  
    5252
    5353class WorkQueue {
     54    WTF_MAKE_NONCOPYABLE(WorkQueue);
     55
    5456public:
    5557    explicit WorkQueue(const char* name);

  • trunk/Source/WebKit2/PluginProcess/PluginProcess.cpp

    r76916 r77874  
    6262
    6363    m_connection = CoreIPC::Connection::createClientConnection(serverIdentifier, this, RunLoop::main());
     64    m_connection->setDidCloseOnConnectionWorkQueueCallback(didCloseOnConnectionWorkQueue);
    6465    m_connection->open();
    6566}

  • trunk/Source/WebKit2/Shared/ChildProcess.cpp

    r76916 r77874  
    4949}
    5050
    51 void ChildProcess::didCloseOnConnectionWorkQueue(WorkQueue* workQueue, CoreIPC::Connection*)
     51void ChildProcess::didCloseOnConnectionWorkQueue(WorkQueue& workQueue, CoreIPC::Connection*)
    5252{
    5353    // If the connection has been closed and we haven't responded in the main thread for 10 seconds
    … …  
    5555    static const double watchdogDelay = 10.0;
    5656   
    57     workQueue->scheduleWorkAfterDelay(WorkItem::create(watchdogCallback), watchdogDelay);
     57    workQueue.scheduleWorkAfterDelay(WorkItem::create(watchdogCallback), watchdogDelay);
    5858}
    5959   

  • trunk/Source/WebKit2/Shared/ChildProcess.h

    r76248 r77874  
    3737    ~ChildProcess();
    3838
    39 private:
    40     void didCloseOnConnectionWorkQueue(WorkQueue*, CoreIPC::Connection*);
     39    static void didCloseOnConnectionWorkQueue(WorkQueue&, CoreIPC::Connection*);
    4140};
    4241

  • trunk/Source/WebKit2/WebProcess/WebProcess.cpp

    r76916 r77874  
    128128
    129129    m_connection = CoreIPC::Connection::createClientConnection(serverIdentifier, this, runLoop);
     130    m_connection->setDidCloseOnConnectionWorkQueueCallback(didCloseOnConnectionWorkQueue);
     131
    130132    m_connection->open();
    131133
Note: See TracChangeset for help on using the changeset viewer.