Bug 183046 - ServiceWorkerContainer::scheduleJob() fails to isolate copy the jobData before passing it to the main thread
Summary: ServiceWorkerContainer::scheduleJob() fails to isolate copy the jobData befor...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Service Workers (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Chris Dumez
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2018-02-22 10:49 PST by Chris Dumez
Modified: 2018-02-22 11:46 PST (History)
5 users (show)

See Also:


Attachments
Patch (2.00 KB, patch)
2018-02-22 10:58 PST, Chris Dumez
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Dumez 2018-02-22 10:49:30 PST
ServiceWorkerContainer::scheduleJob() fails to isolate copy the jobData before passing it to the main thread.
Comment 1 Radar WebKit Bug Importer 2018-02-22 10:50:07 PST
<rdar://problem/37793395>
Comment 2 Chris Dumez 2018-02-22 10:51:18 PST
I suspect this is the reason for those crashes:
Thread 5 Crashed ↩:: WebCore: Worker
0   libsystem_platform.dylib      	0x00007fff7580cf49 _platform_memmove$VARIANT$Haswell + 41
1   com.apple.JavaScriptCore      	0x00007fff4fd8c761 WTF::StringImpl::create(unsigned short const*, unsigned int) + 177
2   com.apple.JavaScriptCore      	0x00007fff4fd8bc1e WTF::String::isolatedCopy() const & + 46
3   com.apple.WebCore             	0x00007fff5b57f8e1 WebCore::ResourceRequestBase::setAsIsolatedCopy(WebCore::ResourceRequest const&) + 657
4   com.apple.WebCore             	0x00007fff5b57f63b WebCore::ResourceRequestBase::isolatedCopy() const + 107
5   com.apple.WebCore             	0x00007fff5b34b049 WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge(WebCore::ThreadableLoaderClientWrapper&, WebCore::WorkerLoaderProxy&, WTF::String const&, WebCore::ResourceRequest&&, WebCore::ThreadableLoaderOptions const&, WTF::String const&, WebCore::WorkerGlobalScope&) + 745
6   com.apple.WebCore             	0x00007fff5b34aa52 WebCore::WorkerThreadableLoader::WorkerThreadableLoader(WebCore::WorkerGlobalScope&, WebCore::ThreadableLoaderClient&, WTF::String const&, WebCore::ResourceRequest&&, WebCore::ThreadableLoaderOptions const&, WTF::String const&) + 226
7   com.apple.WebCore             	0x00007fff5b34a577 WebCore::ThreadableLoader::create(WebCore::ScriptExecutionContext&, WebCore::ThreadableLoaderClient&, WebCore::ResourceRequest&&, WebCore::ThreadableLoaderOptions const&, WTF::String&&) + 103
8   com.apple.WebCore             	0x00007fff5b832f63 WebCore::WorkerScriptLoader::loadAsynchronously(WebCore::ScriptExecutionContext&, WebCore::ResourceRequest&&, WebCore::FetchOptions::Mode, WebCore::FetchOptions::Cache, WebCore::FetchOptions::Redirect, WebCore::ContentSecurityPolicyEnforcement, WebCore::WorkerScriptLoaderClient&) + 819
9   com.apple.WebCore             	0x00007fff5b842c6d WebCore::ServiceWorkerJob::fetchScriptWithContext(WebCore::ScriptExecutionContext&, WebCore::FetchOptions::Cache) + 381
10  com.apple.WebCore             	0x00007fff5b83bfa8 WTF::Function<void (WebCore::ScriptExecutionContext&)>::CallableWrapper<WebCore::SWClientConnection::postTaskForJob(WTF::ObjectIdentifier<WebCore::ServiceWorkerJobIdentifierType>, WebCore::SWClientConnection::IsJobComplete, WTF::Function<void (WebCore::ServiceWorkerJob&)>&&)::$_2>::call(WebCore::ScriptExecutionContext&) + 72
11  com.apple.WebCore             	0x00007fff5b831ed0 WebCore::WorkerRunLoop::runInMode(WebCore::WorkerGlobalScope*, WebCore::ModePredicate const&, WebCore::WorkerRunLoop::WaitMode) + 416
12  com.apple.WebCore             	0x00007fff5b831cd0 WebCore::WorkerRunLoop::run(WebCore::WorkerGlobalScope*) + 96
13  com.apple.WebCore             	0x00007fff5b834276 WebCore::WorkerThread::workerThread() + 1030
14  com.apple.JavaScriptCore      	0x00007fff50962f44 WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) + 228
15  com.apple.JavaScriptCore      	0x00007fff4fd8c209 WTF::wtfThreadEntryPoint(void*) + 9
16  libsystem_pthread.dylib       	0x00007fff758136c1 _pthread_body + 340
17  libsystem_pthread.dylib       	0x00007fff7581356d _pthread_start + 377
18  libsystem_pthread.dylib       	0x00007fff75812c5d thread_start + 13

Since ServiceWorkerJob::fetchScriptWithContext() uses the scriptURL from the jobData to construct the ResourceRequest.
Comment 3 Chris Dumez 2018-02-22 10:58:57 PST
Created attachment 334457 [details]
Patch
Comment 4 WebKit Commit Bot 2018-02-22 11:46:22 PST
Comment on attachment 334457 [details]
Patch

Clearing flags on attachment: 334457

Committed r228928: <https://trac.webkit.org/changeset/228928>
Comment 5 WebKit Commit Bot 2018-02-22 11:46:23 PST
All reviewed patches have been landed.  Closing bug.