WebKit Bugzilla
Attachment 342626 Details for
Bug 186584
: Crash under SWServer::unregisterConnection(Connection&)
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
Patch
bug-186584-20180612210750.patch (text/plain), 20.40 KB, created by
Chris Dumez
on 2018-06-12 21:07:51 PDT
(
hide
)
Description:
Patch
Filename:
MIME Type:
Creator:
Chris Dumez
Created:
2018-06-12 21:07:51 PDT
Size:
20.40 KB
patch
obsolete
>Subversion Revision: 232781 >diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog >index 852f833009f84fa46e6fda05ee41ab2299e0d5a7..7951f8f278585f87df87a46101349c3baf75fe94 100644 >--- a/Source/WebCore/ChangeLog >+++ b/Source/WebCore/ChangeLog >@@ -1,3 +1,38 @@ >+2018-06-12 Chris Dumez <cdumez@apple.com> >+ >+ Crash under SWServer::unregisterConnection(Connection&) >+ https://bugs.webkit.org/show_bug.cgi?id=186584 >+ <rdar://problem/40931680> >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ The crash was due to SWServer::Connection objects outliving their SWServer, even >+ though SWServer::Connection::m_server is a C++ reference. This was possible because >+ SWServer does not own the connections, StorageToWebProcessConnection does. This >+ started crashing recently, after r232423, because SWServer can get destroyed now. >+ The SWServer might get destroyed before the StorageToWebProcessConnection, in which >+ case the SWServer::Connection objects will get destroyed later. We were crashing >+ because the SWServer::Connection destructor tries to unregister the connection from >+ the SWServer (which is dead). >+ >+ To address the issue, the SWServer destructor now calls connectionInvalidated() on >+ all its connections. connectionInvalidated() takes care of asking StorageToWebProcessConnection >+ to destroy the SWServer::Connection. >+ >+ * workers/service/server/SWServer.cpp: >+ (WebCore::SWServer::Connection::Connection): >+ (WebCore::SWServer::Connection::~Connection): >+ (WebCore::SWServer::Connection::connectionInvalidated): >+ (WebCore::SWServer::~SWServer): >+ (WebCore::SWServer::Connection::finishFetchingScriptInServer): >+ (WebCore::SWServer::Connection::didResolveRegistrationPromise): >+ (WebCore::SWServer::Connection::addServiceWorkerRegistrationInServer): >+ (WebCore::SWServer::Connection::removeServiceWorkerRegistrationInServer): >+ (WebCore::SWServer::Connection::syncTerminateWorker): >+ * workers/service/server/SWServer.h: >+ (WebCore::SWServer::Connection::doRegistrationMatching): >+ (WebCore::SWServer::Connection::server): >+ > 2018-06-12 Ryosuke Niwa <rniwa@webkit.org> > > iOS WK1: Occasional crash in FrameView::setScrollPosition >diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog >index a777d75e06dafa3f7df0f9b2911b6d753dae328f..7afadcd57211344a934fb7cb45722fd434990fef 100644 >--- a/Source/WebKit/ChangeLog >+++ b/Source/WebKit/ChangeLog >@@ -1,3 +1,29 @@ >+2018-06-12 Chris Dumez <cdumez@apple.com> >+ >+ Crash under SWServer::unregisterConnection(Connection&) >+ https://bugs.webkit.org/show_bug.cgi?id=186584 >+ <rdar://problem/40931680> >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ * StorageProcess/ServiceWorker/WebSWServerConnection.cpp: >+ (WebKit::WebSWServerConnection::WebSWServerConnection): >+ (WebKit::WebSWServerConnection::ipcConnection const): >+ (WebKit::WebSWServerConnection::startFetch): >+ (WebKit::WebSWServerConnection::didReceiveFetchResponse): >+ (WebKit::WebSWServerConnection::didReceiveFetchData): >+ (WebKit::WebSWServerConnection::didReceiveFetchFormData): >+ (WebKit::WebSWServerConnection::didFinishFetch): >+ (WebKit::WebSWServerConnection::didFailFetch): >+ (WebKit::WebSWServerConnection::didNotHandleFetch): >+ (WebKit::WebSWServerConnection::connectionInvalidated): >+ * StorageProcess/ServiceWorker/WebSWServerConnection.h: >+ (WebKit::WebSWServerConnection::ipcConnection const): Deleted. >+ * StorageProcess/StorageToWebProcessConnection.cpp: >+ (WebKit::StorageToWebProcessConnection::establishSWServerConnection): >+ (WebKit::StorageToWebProcessConnection::swServerConnectionInvalidated): >+ * StorageProcess/StorageToWebProcessConnection.h: >+ > 2018-06-12 Brent Fulgham <bfulgham@apple.com> > > Turn CSS Spring Animations and Link Preload off by default for production builds. >diff --git a/Source/WebCore/workers/service/server/SWServer.cpp b/Source/WebCore/workers/service/server/SWServer.cpp >index 08c31a79029a5dad36526af2e14db787d356a744..1779312788b2d84f4958d40f0ff1c15188256cac 100644 >--- a/Source/WebCore/workers/service/server/SWServer.cpp >+++ b/Source/WebCore/workers/service/server/SWServer.cpp >@@ -51,15 +51,20 @@ namespace WebCore { > static Seconds terminationDelay { 10_s }; > > SWServer::Connection::Connection(SWServer& server) >- : m_server(server) >+ : m_server(&server) > , m_identifier(generateObjectIdentifier<SWServerConnectionIdentifierType>()) > { >- m_server.registerConnection(*this); >+ server.registerConnection(*this); > } > > SWServer::Connection::~Connection() > { >- m_server.unregisterConnection(*this); >+ server().unregisterConnection(*this); >+} >+ >+void SWServer::Connection::connectionInvalidated() >+{ >+ m_server = nullptr; > } > > HashSet<SWServer*>& SWServer::allServers() >@@ -70,6 +75,9 @@ HashSet<SWServer*>& SWServer::allServers() > > SWServer::~SWServer() > { >+ while (!m_connections.isEmpty()) >+ (*m_connections.values().begin())->connectionInvalidated(); >+ > allServers().remove(this); > } > >@@ -244,28 +252,28 @@ void SWServer::clear(const SecurityOriginData& securityOrigin, CompletionHandler > > void SWServer::Connection::finishFetchingScriptInServer(const ServiceWorkerFetchResult& result) > { >- m_server.scriptFetchFinished(*this, result); >+ server().scriptFetchFinished(*this, result); > } > > void SWServer::Connection::didResolveRegistrationPromise(const ServiceWorkerRegistrationKey& key) > { >- m_server.didResolveRegistrationPromise(*this, key); >+ server().didResolveRegistrationPromise(*this, key); > } > > void SWServer::Connection::addServiceWorkerRegistrationInServer(ServiceWorkerRegistrationIdentifier identifier) > { >- m_server.addClientServiceWorkerRegistration(*this, identifier); >+ server().addClientServiceWorkerRegistration(*this, identifier); > } > > void SWServer::Connection::removeServiceWorkerRegistrationInServer(ServiceWorkerRegistrationIdentifier identifier) > { >- m_server.removeClientServiceWorkerRegistration(*this, identifier); >+ server().removeClientServiceWorkerRegistration(*this, identifier); > } > > void SWServer::Connection::syncTerminateWorker(ServiceWorkerIdentifier identifier) > { >- if (auto* worker = m_server.workerByID(identifier)) >- m_server.syncTerminateWorker(*worker); >+ if (auto* worker = server().workerByID(identifier)) >+ server().syncTerminateWorker(*worker); > } > > SWServer::SWServer(UniqueRef<SWOriginStore>&& originStore, String&& registrationDatabaseDirectory, PAL::SessionID sessionID) >diff --git a/Source/WebCore/workers/service/server/SWServer.h b/Source/WebCore/workers/service/server/SWServer.h >index 49aec184ffaa99c86cd134a576034a492c6cd970..45148f8b0fc55d62501eb83adc6e568b5b249b9d 100644 >--- a/Source/WebCore/workers/service/server/SWServer.h >+++ b/Source/WebCore/workers/service/server/SWServer.h >@@ -71,11 +71,13 @@ public: > public: > WEBCORE_EXPORT virtual ~Connection(); > >+ WEBCORE_EXPORT virtual void connectionInvalidated(); >+ > using Identifier = SWServerConnectionIdentifier; > Identifier identifier() const { return m_identifier; } > > WEBCORE_EXPORT void didResolveRegistrationPromise(const ServiceWorkerRegistrationKey&); >- SWServerRegistration* doRegistrationMatching(const SecurityOriginData& topOrigin, const URL& clientURL) { return m_server.doRegistrationMatching(topOrigin, clientURL); } >+ SWServerRegistration* doRegistrationMatching(const SecurityOriginData& topOrigin, const URL& clientURL) { return server().doRegistrationMatching(topOrigin, clientURL); } > void resolveRegistrationReadyRequests(SWServerRegistration&); > > // Messages to the client WebProcess >@@ -89,7 +91,7 @@ public: > > protected: > WEBCORE_EXPORT explicit Connection(SWServer&); >- SWServer& server() { return m_server; } >+ SWServer& server() { ASSERT(m_server); return *m_server; } > > WEBCORE_EXPORT void finishFetchingScriptInServer(const ServiceWorkerFetchResult&); > WEBCORE_EXPORT void addServiceWorkerRegistrationInServer(ServiceWorkerRegistrationIdentifier); >@@ -110,7 +112,7 @@ public: > uint64_t identifier; > }; > >- SWServer& m_server; >+ SWServer* m_server; > Identifier m_identifier; > Vector<RegistrationReadyRequest> m_registrationReadyRequests; > }; >diff --git a/Source/WebKit/StorageProcess/ServiceWorker/WebSWServerConnection.cpp b/Source/WebKit/StorageProcess/ServiceWorker/WebSWServerConnection.cpp >index a941843d4f8b19e7e7becdaa54054ce33bebcee2..9bdbdd98db1678b87b82b9db81bcf1536d8d4ad0 100644 >--- a/Source/WebKit/StorageProcess/ServiceWorker/WebSWServerConnection.cpp >+++ b/Source/WebKit/StorageProcess/ServiceWorker/WebSWServerConnection.cpp >@@ -32,6 +32,7 @@ > #include "Logging.h" > #include "ServiceWorkerClientFetchMessages.h" > #include "StorageProcess.h" >+#include "StorageToWebProcessConnection.h" > #include "StorageToWebProcessConnectionMessages.h" > #include "WebCoreArgumentCoders.h" > #include "WebProcess.h" >@@ -61,10 +62,10 @@ namespace WebKit { > #define SWSERVERCONNECTION_RELEASE_LOG_IF_ALLOWED(fmt, ...) RELEASE_LOG_IF(m_sessionID.isAlwaysOnLoggingAllowed(), ServiceWorker, "%p - WebSWServerConnection::" fmt, this, ##__VA_ARGS__) > #define SWSERVERCONNECTION_RELEASE_LOG_ERROR_IF_ALLOWED(fmt, ...) RELEASE_LOG_ERROR_IF(m_sessionID.isAlwaysOnLoggingAllowed(), ServiceWorker, "%p - WebSWServerConnection::" fmt, this, ##__VA_ARGS__) > >-WebSWServerConnection::WebSWServerConnection(SWServer& server, IPC::Connection& connection, SessionID sessionID) >+WebSWServerConnection::WebSWServerConnection(StorageToWebProcessConnection& storageToWebProcessConnection, SWServer& server, SessionID sessionID) > : SWServer::Connection(server) >+ , m_storageToWebProcessConnection(storageToWebProcessConnection) > , m_sessionID(sessionID) >- , m_contentConnection(connection) > { > StorageProcess::singleton().registerSWServerConnection(*this); > } >@@ -76,6 +77,11 @@ WebSWServerConnection::~WebSWServerConnection() > server().unregisterServiceWorkerClient(keyValue.value, keyValue.key); > } > >+IPC::Connection& WebSWServerConnection::ipcConnection() const >+{ >+ return m_storageToWebProcessConnection.connection(); >+} >+ > void WebSWServerConnection::disconnectedFromWebProcess() > { > notImplemented(); >@@ -149,7 +155,7 @@ void WebSWServerConnection::startFetch(ServiceWorkerRegistrationIdentifier servi > auto* worker = server().activeWorkerFromRegistrationID(serviceWorkerRegistrationIdentifier); > if (!worker) { > SWSERVERCONNECTION_RELEASE_LOG_ERROR_IF_ALLOWED("startFetch: fetchIdentifier: %s -> DidNotHandle because no active worker", fetchIdentifier.loggingString().utf8().data()); >- m_contentConnection->send(Messages::ServiceWorkerClientFetch::DidNotHandle { }, fetchIdentifier.toUInt64()); >+ ipcConnection().send(Messages::ServiceWorkerClientFetch::DidNotHandle { }, fetchIdentifier.toUInt64()); > return; > } > auto serviceWorkerIdentifier = worker->identifier(); >@@ -160,13 +166,13 @@ void WebSWServerConnection::startFetch(ServiceWorkerRegistrationIdentifier servi > > if (!success) { > SWSERVERCONNECTION_RELEASE_LOG_ERROR_IF_ALLOWED("startFetch: fetchIdentifier: %s DidNotHandle because worker did not become activated", fetchIdentifier.loggingString().utf8().data()); >- m_contentConnection->send(Messages::ServiceWorkerClientFetch::DidNotHandle { }, fetchIdentifier.toUInt64()); >+ ipcConnection().send(Messages::ServiceWorkerClientFetch::DidNotHandle { }, fetchIdentifier.toUInt64()); > return; > } > > auto* worker = server().workerByID(serviceWorkerIdentifier); > if (!worker) { >- m_contentConnection->send(Messages::ServiceWorkerClientFetch::DidNotHandle { }, fetchIdentifier.toUInt64()); >+ ipcConnection().send(Messages::ServiceWorkerClientFetch::DidNotHandle { }, fetchIdentifier.toUInt64()); > return; > } > >@@ -182,7 +188,7 @@ void WebSWServerConnection::startFetch(ServiceWorkerRegistrationIdentifier servi > sendToContextProcess(*contextConnection, Messages::WebSWContextManagerConnection::StartFetch { this->identifier(), serviceWorkerIdentifier, fetchIdentifier, request, options, formData, referrer }); > } else { > SWSERVERCONNECTION_RELEASE_LOG_ERROR_IF_ALLOWED("startFetch: fetchIdentifier: %s DidNotHandle because failed to run service worker", fetchIdentifier.loggingString().utf8().data()); >- m_contentConnection->send(Messages::ServiceWorkerClientFetch::DidNotHandle { }, fetchIdentifier.toUInt64()); >+ this->ipcConnection().send(Messages::ServiceWorkerClientFetch::DidNotHandle { }, fetchIdentifier.toUInt64()); > } > }); > }; >@@ -237,35 +243,35 @@ void WebSWServerConnection::scheduleJobInServer(ServiceWorkerJobData&& jobData) > > void WebSWServerConnection::didReceiveFetchResponse(FetchIdentifier fetchIdentifier, const ResourceResponse& response) > { >- m_contentConnection->send(Messages::ServiceWorkerClientFetch::DidReceiveResponse { response }, fetchIdentifier.toUInt64()); >+ ipcConnection().send(Messages::ServiceWorkerClientFetch::DidReceiveResponse { response }, fetchIdentifier.toUInt64()); > } > > void WebSWServerConnection::didReceiveFetchData(FetchIdentifier fetchIdentifier, const IPC::DataReference& data, int64_t encodedDataLength) > { >- m_contentConnection->send(Messages::ServiceWorkerClientFetch::DidReceiveData { data, encodedDataLength }, fetchIdentifier.toUInt64()); >+ ipcConnection().send(Messages::ServiceWorkerClientFetch::DidReceiveData { data, encodedDataLength }, fetchIdentifier.toUInt64()); > } > > void WebSWServerConnection::didReceiveFetchFormData(FetchIdentifier fetchIdentifier, const IPC::FormDataReference& formData) > { >- m_contentConnection->send(Messages::ServiceWorkerClientFetch::DidReceiveFormData { formData }, fetchIdentifier.toUInt64()); >+ ipcConnection().send(Messages::ServiceWorkerClientFetch::DidReceiveFormData { formData }, fetchIdentifier.toUInt64()); > } > > void WebSWServerConnection::didFinishFetch(FetchIdentifier fetchIdentifier) > { > SWSERVERCONNECTION_RELEASE_LOG_IF_ALLOWED("didFinishFetch: fetchIdentifier: %s", fetchIdentifier.loggingString().utf8().data()); >- m_contentConnection->send(Messages::ServiceWorkerClientFetch::DidFinish { }, fetchIdentifier.toUInt64()); >+ ipcConnection().send(Messages::ServiceWorkerClientFetch::DidFinish { }, fetchIdentifier.toUInt64()); > } > > void WebSWServerConnection::didFailFetch(FetchIdentifier fetchIdentifier, const ResourceError& error) > { > SWSERVERCONNECTION_RELEASE_LOG_ERROR_IF_ALLOWED("didFailFetch: fetchIdentifier: %s", fetchIdentifier.loggingString().utf8().data()); >- m_contentConnection->send(Messages::ServiceWorkerClientFetch::DidFail { error }, fetchIdentifier.toUInt64()); >+ ipcConnection().send(Messages::ServiceWorkerClientFetch::DidFail { error }, fetchIdentifier.toUInt64()); > } > > void WebSWServerConnection::didNotHandleFetch(FetchIdentifier fetchIdentifier) > { > SWSERVERCONNECTION_RELEASE_LOG_IF_ALLOWED("didNotHandleFetch: fetchIdentifier: %s", fetchIdentifier.loggingString().utf8().data()); >- m_contentConnection->send(Messages::ServiceWorkerClientFetch::DidNotHandle { }, fetchIdentifier.toUInt64()); >+ ipcConnection().send(Messages::ServiceWorkerClientFetch::DidNotHandle { }, fetchIdentifier.toUInt64()); > } > > void WebSWServerConnection::postMessageToServiceWorkerClient(DocumentIdentifier destinationContextIdentifier, MessageWithMessagePorts&& message, ServiceWorkerIdentifier sourceIdentifier, const String& sourceOrigin) >@@ -314,6 +320,12 @@ void WebSWServerConnection::unregisterServiceWorkerClient(const ServiceWorkerCli > m_clientOrigins.remove(iterator); > } > >+void WebSWServerConnection::connectionInvalidated() >+{ >+ SWServer::Connection::connectionInvalidated(); >+ m_storageToWebProcessConnection.swServerConnectionInvalidated(identifier()); >+} >+ > template<typename U> void WebSWServerConnection::sendToContextProcess(WebCore::SWServerToContextConnection& connection, U&& message) > { > static_cast<WebSWServerToContextConnection&>(connection).send(WTFMove(message)); >diff --git a/Source/WebKit/StorageProcess/ServiceWorker/WebSWServerConnection.h b/Source/WebKit/StorageProcess/ServiceWorker/WebSWServerConnection.h >index 9cf90464f1516f6a1fc8af18cb81368ce65d9809..48eabaa2dd9ecd39002c70a11c74ad92c0a18b43 100644 >--- a/Source/WebKit/StorageProcess/ServiceWorker/WebSWServerConnection.h >+++ b/Source/WebKit/StorageProcess/ServiceWorker/WebSWServerConnection.h >@@ -48,13 +48,17 @@ struct ServiceWorkerClientData; > > namespace WebKit { > >+class StorageToWebProcessConnection; >+ > class WebSWServerConnection : public WebCore::SWServer::Connection, public IPC::MessageSender, public IPC::MessageReceiver { > public: >- WebSWServerConnection(WebCore::SWServer&, IPC::Connection&, PAL::SessionID); >+ WebSWServerConnection(StorageToWebProcessConnection&, WebCore::SWServer&, PAL::SessionID); > WebSWServerConnection(const WebSWServerConnection&) = delete; > ~WebSWServerConnection() final; > >- IPC::Connection& ipcConnection() const { return m_contentConnection.get(); } >+ void connectionInvalidated() final; >+ >+ IPC::Connection& ipcConnection() const; > > void disconnectedFromWebProcess(); > void didReceiveMessage(IPC::Connection&, IPC::Decoder&) final; >@@ -97,13 +101,13 @@ private: > void registerServiceWorkerClient(WebCore::SecurityOriginData&& topOrigin, WebCore::ServiceWorkerClientData&&, const std::optional<WebCore::ServiceWorkerRegistrationIdentifier>&); > void unregisterServiceWorkerClient(const WebCore::ServiceWorkerClientIdentifier&); > >- IPC::Connection* messageSenderConnection() final { return m_contentConnection.ptr(); } >+ IPC::Connection* messageSenderConnection() final { return &ipcConnection(); } > uint64_t messageSenderDestinationID() final { return identifier().toUInt64(); } > > template<typename U> static void sendToContextProcess(WebCore::SWServerToContextConnection&, U&& message); > >+ StorageToWebProcessConnection& m_storageToWebProcessConnection; > PAL::SessionID m_sessionID; >- Ref<IPC::Connection> m_contentConnection; > HashMap<WebCore::ServiceWorkerClientIdentifier, WebCore::ClientOrigin> m_clientOrigins; > }; > >diff --git a/Source/WebKit/StorageProcess/StorageToWebProcessConnection.cpp b/Source/WebKit/StorageProcess/StorageToWebProcessConnection.cpp >index ae75c85cc7e50aa8a421836f05e1172959898cf7..a6de40f15c4351e83f7109164b3ee9f8a4374872 100644 >--- a/Source/WebKit/StorageProcess/StorageToWebProcessConnection.cpp >+++ b/Source/WebKit/StorageProcess/StorageToWebProcessConnection.cpp >@@ -164,7 +164,7 @@ void StorageToWebProcessConnection::didReceiveInvalidMessage(IPC::Connection&, I > void StorageToWebProcessConnection::establishSWServerConnection(SessionID sessionID, SWServerConnectionIdentifier& serverConnectionIdentifier) > { > auto& server = StorageProcess::singleton().swServerForSession(sessionID); >- auto connection = std::make_unique<WebSWServerConnection>(server, m_connection.get(), sessionID); >+ auto connection = std::make_unique<WebSWServerConnection>(*this, server, sessionID); > > serverConnectionIdentifier = connection->identifier(); > LOG(ServiceWorker, "StorageToWebProcessConnection::establishSWServerConnection - %s", serverConnectionIdentifier.loggingString().utf8().data()); >@@ -173,6 +173,12 @@ void StorageToWebProcessConnection::establishSWServerConnection(SessionID sessio > auto addResult = m_swConnections.add(serverConnectionIdentifier, WTFMove(connection)); > ASSERT_UNUSED(addResult, addResult.isNewEntry); > } >+ >+void StorageToWebProcessConnection::swServerConnectionInvalidated(SWServerConnectionIdentifier identifier) >+{ >+ ASSERT(m_swConnections.contains(identifier)); >+ m_swConnections.remove(identifier); >+} > #endif > > #if ENABLE(INDEXED_DATABASE) >diff --git a/Source/WebKit/StorageProcess/StorageToWebProcessConnection.h b/Source/WebKit/StorageProcess/StorageToWebProcessConnection.h >index 71e27efc2df6a012b3260a529d093588f6c2348c..fe9e0ea4f18f03a3f00970b5175d0caff914d574 100644 >--- a/Source/WebKit/StorageProcess/StorageToWebProcessConnection.h >+++ b/Source/WebKit/StorageProcess/StorageToWebProcessConnection.h >@@ -45,6 +45,10 @@ public: > > IPC::Connection& connection() { return m_connection.get(); } > >+#if ENABLE(SERVICE_WORKER) >+ void swServerConnectionInvalidated(WebCore::SWServerConnectionIdentifier); >+#endif >+ > private: > StorageToWebProcessConnection(IPC::Connection::Identifier); >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Flags:
ews-watchlist
:
commit-queue-
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 186584
:
342625
|
342626
|
342633
|
342636
|
342658
|
342685
|
342703
|
342704
|
342711
|
342716