Bug 187188 - Introduce defaultProcessPool to solve potential data corruption when using multiple WKWebViews
Summary: Introduce defaultProcessPool to solve potential data corruption when using mu...
Status: RESOLVED WONTFIX
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Sihui Liu
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-06-29 11:55 PDT by Sihui Liu
Modified: 2018-08-17 14:58 PDT (History)
2 users (show)

See Also:


Attachments
Patch (5.98 KB, patch)
2018-06-29 12:46 PDT, Sihui Liu
ews-watchlist: commit-queue-
Details | Formatted Diff | Diff
Archive of layout-test-results from ews205 for win-future (12.78 MB, application/zip)
2018-06-29 14:39 PDT, EWS Watchlist
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Sihui Liu 2018-06-29 11:55:00 PDT
By default, WebKit would create a new WKProcessPool for each WKWebView, and all WKWebViews share one DefaultDataStore. As each processPool has its own network process and storage process, data corruption may happen when multiple network/storage processes use same data store at the same time.
Comment 1 Sihui Liu 2018-06-29 12:46:18 PDT
Created attachment 343933 [details]
Patch
Comment 2 Sihui Liu 2018-06-29 12:47:00 PDT
(In reply to Sihui Liu from comment #1)
> Created attachment 343933 [details]
> Patch

Initial patch for checking the test results.
Comment 3 EWS Watchlist 2018-06-29 12:47:47 PDT
Attachment 343933 [details] did not pass style-queue:


ERROR: Source/WebKit/UIProcess/API/Cocoa/WKWebViewConfiguration.mm:418:  More than one command on the same line  [whitespace/newline] [4]
Total errors found: 1 in 8 files


If any of these errors are false positives, please file a bug against check-webkit-style.
Comment 4 Geoffrey Garen 2018-06-29 13:29:58 PDT
Comment on attachment 343933 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=343933&action=review

> Source/WebKit/UIProcess/API/Cocoa/WKProcessPool.h:42
>  @interface WKProcessPool : NSObject <NSSecureCoding>
> ++ (WKProcessPool *)defaultProcessPool;
>  @end
>  

I think we should put this in WKProcessPoolPrivate.h for now. We can offer it as public API after we've settled the design a little bit more. One question we should figure out before we offer this as public API is whether we're going to make the change to only ever have one network process per UI process.

> Source/WebKit/UIProcess/WebProcessPool.cpp:131
> +static WebProcessPool* globalDefaultProcessPool;

You can declare this static inside WebProcessPool::defaultProcessPool() to encapsulate it a little better.

> Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp:1359
> +    if (processPools.isEmpty())
> +        processPools.add(WebProcessPool::defaultProcessPool().ptr());

This doesn't seem right to me. This function returns all the process pools that this website data store has been used with. But not all website data stores are necessarily used with the default process pool. So why is it correct to return the default process pool? And if it's correct, why do we return it only if we don't have another process pool?
Comment 5 Geoffrey Garen 2018-06-29 13:34:21 PDT
Comment on attachment 343933 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=343933&action=review

> Source/WebKit/UIProcess/API/APIHTTPCookieStore.cpp:45
> +    if (!pool)
>          registerForNewProcessPoolNotifications();

This patch makes it so that pool is never null. If we keep that behavior, we should remove this check for null, and even change processPoolForCookieStorageOperations() to return a reference rather than a pointer.

But we might need to keep that old null behavior, at least for now -- depending on what we decide to do in WebsiteDataStore::processPools().
Comment 6 EWS Watchlist 2018-06-29 14:38:59 PDT
Comment on attachment 343933 [details]
Patch

Attachment 343933 [details] did not pass win-ews (win):
Output: https://webkit-queues.webkit.org/results/8387054

New failing tests:
http/tests/security/contentSecurityPolicy/userAgentShadowDOM/allow-audio.html
Comment 7 EWS Watchlist 2018-06-29 14:39:11 PDT
Created attachment 343946 [details]
Archive of layout-test-results from ews205 for win-future

The attached test failures were seen while running run-webkit-tests on the win-ews.
Bot: ews205  Port: win-future  Platform: CYGWIN_NT-6.1-2.9.0-0.318-5-3-x86_64-64bit
Comment 8 Geoffrey Garen 2018-06-29 15:53:34 PDT
Comment on attachment 343933 [details]
Patch

I think we want to do a few things:

(1) Network process and storage process should be singletons, rather than data members per process pool. We believe that network process and storage process know how to handle multiple sessions with multiple website data stores, so there's no need to launch a new network process or storage process when you use a new website data store.

(2) When you want to set a cookie, you should not set a pending cookie. Instead, you should launch the singleton network process if needed, and set the cookie by messaging the singleton network process.

(3) WebProcessPool and ProcessPoolConfiguration should not hold any paths. Only WebsiteDataStore should determine which paths we use when accessing storage on disk. A website data store determines its paths when it registers its session with the networking process or storage process.
Comment 9 Sihui Liu 2018-07-06 17:24:01 PDT
We've agreed to not use defaultProcessPool as a temporary fix as it may cause other problems.
Comment 10 Geoffrey Garen 2018-08-17 14:58:29 PDT
Comment on attachment 343933 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=343933&action=review

>> Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp:1359
>> +        processPools.add(WebProcessPool::defaultProcessPool().ptr());
> 
> This doesn't seem right to me. This function returns all the process pools that this website data store has been used with. But not all website data stores are necessarily used with the default process pool. So why is it correct to return the default process pool? And if it's correct, why do we return it only if we don't have another process pool?

We looked at this again today.

Adding the idea of a default process pool for API clients could work. (SPI clients still have deeper problems.)

If WebsiteDataStore::processPoolForCookieStorageOperations() returned the default process pool when no other process pool was available, that would be correct for API clients because API clients always use the default process pool.

This solution is still not complete because it doesn't address SPI clients, and it doesn't provide a path for API clients to eventually be able to use more than one process pool.