182365 2018-01-31 16:54:47 -0800 [JSCOnly] Ensure RunLoop::Timer is robust to being deleted inside its user callback 2018-02-01 06:51:25 -0800 1 1 1 Unclassified WebKit Web Template Framework Other PC Linux RESOLVED INVALID https://bugs.webkit.org/show_bug.cgi?id=182271 P2 Normal --- 1 mcatanzaro mcatanzaro benjamin cdumez cmarcelo dbates ews-watchlist mcatanzaro ysuzuki oldest_to_newest 1395248 0 mcatanzaro 2018-01-31 16:54:47 -0800 Ensure RunLoop::Timer is robust to being deleted inside its user callback. This is a theoretical issue that I noticed as the result of an actual use-after-free caught by asan in WPE and GTK. See bug #182271. It's not actually possible to test the original reproducer using JSCOnly, because it was a WebKit-layer problem. I'm going to attach a totally-untested, speculative fix for the theoretical issue. I think it's correct. 1395253 1 332825 mcatanzaro 2018-01-31 17:04:48 -0800 Created attachment 332825 Patch 1395255 2 mcatanzaro 2018-01-31 17:08:59 -0800 This should be reviewed by Yusuke, because I'm really not sure whether it's necessary or not. If the RunLoop itself is guaranteed to have another ref on the ScheduledTask, then this isn't needed. 1395374 3 ysuzuki 2018-02-01 00:27:29 -0800 (In reply to Michael Catanzaro from comment #2) > This should be reviewed by Yusuke, because I'm really not sure whether it's > necessary or not. If the RunLoop itself is guaranteed to have another ref on > the ScheduledTask, then this isn't needed. I don't think it is necessary. See L173. When calling ScheduledTask::fired(), RunLoop's code always has ref by `RefPtr<ScheduledTask>`. BTW, this problem is why I separate ScheduledTask from TimerBase IIRC :) 1395443 4 mcatanzaro 2018-02-01 06:51:20 -0800 (In reply to Yusuke Suzuki from comment #3) > I don't think it is necessary. See L173. When calling > ScheduledTask::fired(), RunLoop's code always has ref by > `RefPtr<ScheduledTask>`. > BTW, this problem is why I separate ScheduledTask from TimerBase IIRC :) Good decision ;) 332825 2018-01-31 17:04:48 -0800 2018-02-01 06:51:25 -0800 Patch bug-182365-20180131190447.patch text/plain 1401 mcatanzaro U3VidmVyc2lvbiBSZXZpc2lvbjogMjI3OTQyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV1RGL0NoYW5n ZUxvZyBiL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCmluZGV4IDJiNDU0NjU1ODA5NDE5ODQ1M2ZkYzc3 YmE4M2EzOGEwOWE1M2RkOTYuLjlkOTY1MjQ3OTVmMDljZTViYWQ4N2YwZDY5OGY4YWE1YjBkZDBl MDIgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XVEYvQ2hh bmdlTG9nCkBAIC0xLDMgKzEsMTYgQEAKKzIwMTgtMDEtMzEgIE1pY2hhZWwgQ2F0YW56YXJvICA8 bWNhdGFuemFyb0BpZ2FsaWEuY29tPgorCisgICAgICAgIFtKU0NPbmx5XSBFbnN1cmUgUnVuTG9v cDo6VGltZXIgaXMgcm9idXN0IHRvIGJlaW5nIGRlbGV0ZWQgaW5zaWRlIGl0cyB1c2VyIGNhbGxi YWNrCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xODIz NjUKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUaGlz IGlzIGEgc3BlY3VsYXRpdmUgZml4IGZvciBhIHRoZW9yZXRpY2FsIGlzc3VlLiBFbnN1cmUgdGhl IFNjaGVkdWxlZFRhc2sgZG9lcyBub3QgYWxsb3cKKyAgICAgICAgaXRzZWxmIHRvIGJlIGRlc3Ry b3llZCBieSB0aGUgdXNlci1wcm92aWRlZCBmdW5jdGlvbi4KKworICAgICAgICAqIHd0Zi9nZW5l cmljL1J1bkxvb3BHZW5lcmljLmNwcDoKKyAgICAgICAgKFdURjo6UnVuTG9vcDo6VGltZXJCYXNl OjpTY2hlZHVsZWRUYXNrOjpmaXJlZCk6CisKIDIwMTgtMDEtMzEgIE1hcmsgTGFtICA8bWFyay5s YW1AYXBwbGUuY29tPgogCiAgICAgICAgIEZpeCBzb21lIEFSTTY0XzMyIGJ1aWxkIGZhaWx1cmVz LgpkaWZmIC0tZ2l0IGEvU291cmNlL1dURi93dGYvZ2VuZXJpYy9SdW5Mb29wR2VuZXJpYy5jcHAg Yi9Tb3VyY2UvV1RGL3d0Zi9nZW5lcmljL1J1bkxvb3BHZW5lcmljLmNwcAppbmRleCBhNTY4MGUy Mjg1MzVlNGVlMWMxMmMxN2IyMjJjMjg0MjMyNzA3M2FmLi42MWY0YTQzYmFhOWFjMmUwNWVjZWUy YzNhMTQzMmQ3ODY4Y2EwZDkxIDEwMDY0NAotLS0gYS9Tb3VyY2UvV1RGL3d0Zi9nZW5lcmljL1J1 bkxvb3BHZW5lcmljLmNwcAorKysgYi9Tb3VyY2UvV1RGL3d0Zi9nZW5lcmljL1J1bkxvb3BHZW5l cmljLmNwcApAQCAtNTAsNiArNTAsOCBAQCBwdWJsaWM6CiAgICAgICAgIGlmICghaXNBY3RpdmUo KSkKICAgICAgICAgICAgIHJldHVybiBmYWxzZTsKIAorICAgICAgICAvLyBQcm90ZWN0IGFnYWlu c3QgZGVsZXRpb24gYnkgdGhlIHVzZXItcHJvdmlkZWQgZnVuY3Rpb24uCisgICAgICAgIFJlZjxT Y2hlZHVsZWRUYXNrPiBwcm90ZWN0ZWRUaGlzKCp0aGlzKTsKICAgICAgICAgbV9mdW5jdGlvbigp OwogCiAgICAgICAgIGlmICghbV9pc1JlcGVhdGluZykK