Bug 187356

Summary: Regression(r232886): WebsiteDataStore objects may get destroyed on a background thread
Product: WebKit Reporter: Chris Dumez <cdumez>
Component: WebKit2Assignee: Chris Dumez <cdumez>
Status: RESOLVED FIXED    
Severity: Normal CC: beidson, commit-queue, ggaren, webkit-bug-importer, youennf
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 186682    
Attachments:
Description Flags
Patch none

Chris Dumez
Reported 2018-07-05 12:37:21 PDT
As of r232886, CallbackAggregators in WebsiteDataStore hold a Ref<> to their WebsiteDataStore. This is an issue because CallbackAggregator objects can get destroyed on a background thread and may be the last ones holding a ref to the data store. When this happens, the WebsiteDataStore would get destroyed on a background store and potentially cause crashes. Note that even if the callback aggregator would not be the last one to hold a ref to the store, it still would not be safe to deref the store on the background thread since WebsiteDataStore is not ThreadSafeRefCounted.
Attachments
Patch (6.08 KB, patch)
2018-07-05 12:41 PDT, Chris Dumez 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Chris Dumez
Comment 1 2018-07-05 12:37:37 PDT
<rdar://problem/41854555>
Chris Dumez
Comment 2 2018-07-05 12:41:32 PDT
Created attachment 344353 [details] Patch
Chris Dumez
Comment 3 2018-07-05 12:41:57 PDT
Comment on attachment 344353 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=344353&action=review > Source/WebKit/ChangeLog:17 > + store member on the main thread. Note that we could also have WebsiteDataStore subclass Let me know if you think I should do this instead.
Geoffrey Garen
Comment 4 2018-07-05 13:14:15 PDT
Comment on attachment 344353 [details] Patch r=me I think this is the best design for now because we generally require our API objects to be used only on the main thread. If we ever want to reconsider that requirement, we can reconsider this change too.
WebKit Commit Bot
Comment 5 2018-07-05 13:41:54 PDT
Comment on attachment 344353 [details] Patch Clearing flags on attachment: 344353 Committed r233538: <https://trac.webkit.org/changeset/233538>
WebKit Commit Bot
Comment 6 2018-07-05 13:41:56 PDT
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.