Bug 187356 – Regression(r232886): WebsiteDataStore objects may get destroyed on a background thread

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit2

[Chris Dumez]

As of r232886, CallbackAggregators in WebsiteDataStore hold a Ref<> to their WebsiteDataStore. This is an issue because CallbackAggregator objects can get destroyed on a background thread and may be the last ones holding a ref to the data store. When this happens, the WebsiteDataStore would get destroyed on a background store and potentially cause crashes. Note that even if the callback aggregator would not be the last one to hold a ref to the store, it still would not be safe to deref the store on the background thread since WebsiteDataStore is not ThreadSafeRefCounted.

[Chris Dumez]

<rdar://problem/41854555>

[Chris Dumez]

Created attachment 344353 [details]
Patch

[Chris Dumez]

Comment on attachment 344353 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=344353&action=review

> Source/WebKit/ChangeLog:17
> +        store member on the main thread. Note that we could also have WebsiteDataStore subclass

Let me know if you think I should do this instead.

[Geoffrey Garen]

Comment on attachment 344353 [details]
Patch

r=me

I think this is the best design for now because we generally require our API objects to be used only on the main thread.

If we ever want to reconsider that requirement, we can reconsider this change too.

[WebKit Commit Bot]

Comment on attachment 344353 [details]
Patch

Clearing flags on attachment: 344353

Committed r233538: <https://trac.webkit.org/changeset/233538>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.