Bug 43306 – Crash due to calling StringImpl::createCFString() from non-main thread in plug-in code

• Component: WebKit2
• Status: RESOLVED FIXED

[Sam Weinig]

Crash due to calling StringImpl::createCFString() from non-main thread in plug-in code.


Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x00000000bbadbeef
Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x00000001004aabfe WTF::isMainThread() + 147 (MainThreadMac.mm:136)
1   com.apple.WebCore             	0x00000001015d64a0 WebCore::StringImpl::createCFString() + 28 (StringImplCF.cpp:136)
2   com.apple.WebCore             	0x00000001015d67d1 WebCore::StringImpl::operator NSString*() + 21 (StringImplMac.mm:30)
3   com.apple.WebCore             	0x0000000100ae203d WebCore::String::operator NSString*() const + 55 (WTFString.h:264)
4   com.apple.WebCore             	0x000000010136f6ae WebCore::MIMETypeRegistry::getMIMETypeForExtension(WebCore::String const&) + 42 (MIMETypeRegistryMac.mm:37)
5   com.apple.WebKit2             	0x0000000100035602 WebKit::PluginInfoStore::findPlugin(WebCore::String&, WebCore::KURL const&) + 324 (PluginInfoStore.cpp:174)
6   com.apple.WebKit2             	0x0000000100083c10 WebKit::WebProcessProxy::getPluginHostConnection(WebCore::String const&, WebCore::KURL const&, WebCore::String&) + 76 (WebProcessProxy.cpp:198)
7   com.apple.WebKit2             	0x0000000100083e58 WebKit::WebProcessProxy::didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*, CoreIPC::ArgumentEncoder*) + 422 (WebProcessProxy.cpp:348)
8   com.apple.WebKit2             	0x000000010001a387 CoreIPC::Connection::dispatchMessages() + 357 (Connection.cpp:264)
...

[Sam Weinig]

<rdar://problem/8259687>

[Sam Weinig]

Created attachment 63165 [details]
Patch

[Darin Adler]

Comment on attachment 63165 [details]
Patch

Won't this leave Windows broken?

[Sam Weinig]

(In reply to comment #3)
> (From update of attachment 63165 [details])
> Won't this leave Windows broken?

I don't think it should, there is a default implementation in PluginInfoStore.cpp that is wrapped in #if !PLATFORM(MAC) that calls the MIMETypeRegistry and the windows implementation does not convert to a CFStringRef in it.

[Sam Weinig]

Landed in r64430.