Bug 183046 – ServiceWorkerContainer::scheduleJob() fails to isolate copy the jobData before passing it to the main thread

• Status: RESOLVED
• Resolution: FIXED
• Component: Service Workers

[Chris Dumez]

ServiceWorkerContainer::scheduleJob() fails to isolate copy the jobData before passing it to the main thread.

[Radar WebKit Bug Importer]

<rdar://problem/37793395>

[Chris Dumez]

I suspect this is the reason for those crashes:
Thread 5 Crashed ↩:: WebCore: Worker
0   libsystem_platform.dylib      	0x00007fff7580cf49 _platform_memmove$VARIANT$Haswell + 41
1   com.apple.JavaScriptCore      	0x00007fff4fd8c761 WTF::StringImpl::create(unsigned short const*, unsigned int) + 177
2   com.apple.JavaScriptCore      	0x00007fff4fd8bc1e WTF::String::isolatedCopy() const & + 46
3   com.apple.WebCore             	0x00007fff5b57f8e1 WebCore::ResourceRequestBase::setAsIsolatedCopy(WebCore::ResourceRequest const&) + 657
4   com.apple.WebCore             	0x00007fff5b57f63b WebCore::ResourceRequestBase::isolatedCopy() const + 107
5   com.apple.WebCore             	0x00007fff5b34b049 WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge(WebCore::ThreadableLoaderClientWrapper&, WebCore::WorkerLoaderProxy&, WTF::String const&, WebCore::ResourceRequest&&, WebCore::ThreadableLoaderOptions const&, WTF::String const&, WebCore::WorkerGlobalScope&) + 745
6   com.apple.WebCore             	0x00007fff5b34aa52 WebCore::WorkerThreadableLoader::WorkerThreadableLoader(WebCore::WorkerGlobalScope&, WebCore::ThreadableLoaderClient&, WTF::String const&, WebCore::ResourceRequest&&, WebCore::ThreadableLoaderOptions const&, WTF::String const&) + 226
7   com.apple.WebCore             	0x00007fff5b34a577 WebCore::ThreadableLoader::create(WebCore::ScriptExecutionContext&, WebCore::ThreadableLoaderClient&, WebCore::ResourceRequest&&, WebCore::ThreadableLoaderOptions const&, WTF::String&&) + 103
8   com.apple.WebCore             	0x00007fff5b832f63 WebCore::WorkerScriptLoader::loadAsynchronously(WebCore::ScriptExecutionContext&, WebCore::ResourceRequest&&, WebCore::FetchOptions::Mode, WebCore::FetchOptions::Cache, WebCore::FetchOptions::Redirect, WebCore::ContentSecurityPolicyEnforcement, WebCore::WorkerScriptLoaderClient&) + 819
9   com.apple.WebCore             	0x00007fff5b842c6d WebCore::ServiceWorkerJob::fetchScriptWithContext(WebCore::ScriptExecutionContext&, WebCore::FetchOptions::Cache) + 381
10  com.apple.WebCore             	0x00007fff5b83bfa8 WTF::Function<void (WebCore::ScriptExecutionContext&)>::CallableWrapper<WebCore::SWClientConnection::postTaskForJob(WTF::ObjectIdentifier<WebCore::ServiceWorkerJobIdentifierType>, WebCore::SWClientConnection::IsJobComplete, WTF::Function<void (WebCore::ServiceWorkerJob&)>&&)::$_2>::call(WebCore::ScriptExecutionContext&) + 72
11  com.apple.WebCore             	0x00007fff5b831ed0 WebCore::WorkerRunLoop::runInMode(WebCore::WorkerGlobalScope*, WebCore::ModePredicate const&, WebCore::WorkerRunLoop::WaitMode) + 416
12  com.apple.WebCore             	0x00007fff5b831cd0 WebCore::WorkerRunLoop::run(WebCore::WorkerGlobalScope*) + 96
13  com.apple.WebCore             	0x00007fff5b834276 WebCore::WorkerThread::workerThread() + 1030
14  com.apple.JavaScriptCore      	0x00007fff50962f44 WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) + 228
15  com.apple.JavaScriptCore      	0x00007fff4fd8c209 WTF::wtfThreadEntryPoint(void*) + 9
16  libsystem_pthread.dylib       	0x00007fff758136c1 _pthread_body + 340
17  libsystem_pthread.dylib       	0x00007fff7581356d _pthread_start + 377
18  libsystem_pthread.dylib       	0x00007fff75812c5d thread_start + 13

Since ServiceWorkerJob::fetchScriptWithContext() uses the scriptURL from the jobData to construct the ResourceRequest.

[Chris Dumez]

Created attachment 334457 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 334457 [details]
Patch

Clearing flags on attachment: 334457

Committed r228928: <https://trac.webkit.org/changeset/228928>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.