Bug 199420 - ThreadSafeRefCounted<DestructionThread::Main> is not safe to use in the UIProcess
Summary: ThreadSafeRefCounted<DestructionThread::Main> is not safe to use in the UIPro...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit2 (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Chris Dumez
URL:
Keywords: InRadar
: 199657 (view as bug list)
Depends on:
Blocks:
 
Reported: 2019-07-02 14:05 PDT by Chris Dumez
Modified: 2019-07-10 09:44 PDT (History)
12 users (show)

See Also:


Attachments
Patch (6.67 KB, patch)
2019-07-02 14:11 PDT, Chris Dumez
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Dumez 2019-07-02 14:05:37 PDT
ThreadSafeRefCounted<DestructionThread::Main> is not safe to use in the UIProcess because its implementation relies on isMainThread() / callOnMainThread(). Those get confused about which thread is the main thread when an application uses both WK1 and WK2.
Comment 1 Chris Dumez 2019-07-02 14:05:54 PDT
<rdar://problem/52289717>
Comment 2 Ryosuke Niwa 2019-07-02 14:06:15 PDT
We can add an assertion to catch this?
Comment 3 Chris Dumez 2019-07-02 14:11:51 PDT
Created attachment 373360 [details]
Patch
Comment 4 Chris Dumez 2019-07-02 14:12:59 PDT
(In reply to Ryosuke Niwa from comment #2)
> We can add an assertion to catch this?

I think it would be great yes, but I am not sure how to write it. I know similar issues came up in the past, did we come up with a solution to catch this?
Comment 5 Ryosuke Niwa 2019-07-02 14:24:13 PDT
(In reply to Chris Dumez from comment #4)
> (In reply to Ryosuke Niwa from comment #2)
> > We can add an assertion to catch this?
> 
> I think it would be great yes, but I am not sure how to write it. I know
> similar issues came up in the past, did we come up with a solution to catch
> this?

There is isInWebProcess() as a runtime check which is a bit cheesy. Ideally, it's something we initialize via XPC bootstrapping instead.
Comment 6 Ryosuke Niwa 2019-07-02 15:25:46 PDT
Comment on attachment 373360 [details]
Patch

How about WebResourceLoadStatisticsStore?
Comment 7 Ryosuke Niwa 2019-07-02 15:26:11 PDT
Also Storage in NetworkCacheStorage.
Comment 8 Ryosuke Niwa 2019-07-02 15:27:47 PDT
Also, RegistrationDatabase and ServiceWorkerFetch::Client in WebCore uses it. Doesn't UI process use any of them?
Comment 9 Chris Dumez 2019-07-02 15:31:46 PDT
(In reply to Ryosuke Niwa from comment #6)
> Comment on attachment 373360 [details]
> Patch
> 
> How about WebResourceLoadStatisticsStore?

Looks like it is in the NetworkProcess noawadays?
Comment 10 Ryosuke Niwa 2019-07-02 15:32:11 PDT
(In reply to Chris Dumez from comment #4)
> (In reply to Ryosuke Niwa from comment #2)
> > We can add an assertion to catch this?
> 
> I think it would be great yes, but I am not sure how to write it. I know
> similar issues came up in the past, did we come up with a solution to catch
> this?

See https://bugs.webkit.org/show_bug.cgi?id=185330
Comment 11 Chris Dumez 2019-07-02 15:32:34 PDT
(In reply to Ryosuke Niwa from comment #7)
> Also Storage in NetworkCacheStorage.

Again, this is in the NetworkProcess so not an issue.
Comment 12 Chris Dumez 2019-07-02 15:33:54 PDT
(In reply to Ryosuke Niwa from comment #8)
> Also, RegistrationDatabase and ServiceWorkerFetch::Client in WebCore uses
> it. Doesn't UI process use any of them?

RegistrationDatabase is used only in the NetworkProcess so not a problem. ServiceWorkerFetch::Client is used in the Service Worker process I believe (So a WebProcess), thus not an issue either.
Comment 13 Chris Dumez 2019-07-02 15:36:02 PDT
(In reply to Chris Dumez from comment #12)
> (In reply to Ryosuke Niwa from comment #8)
> > Also, RegistrationDatabase and ServiceWorkerFetch::Client in WebCore uses
> > it. Doesn't UI process use any of them?
> 
> RegistrationDatabase is used only in the NetworkProcess so not a problem.
> ServiceWorkerFetch::Client is used in the Service Worker process I believe
> (So a WebProcess), thus not an issue either.

To be clear, classes that are used in the Network or WebContent processes, and only by WebKit2 code could use either DestructionThread::Main or DestructionThreadMainRunLoop. They would both be safe AFAIK. The only problematic ones are the ones used in the UIProcess, and I fixed the 2 classes I that were obviously used in the UIProcess.
Comment 14 WebKit Commit Bot 2019-07-02 16:07:51 PDT
Comment on attachment 373360 [details]
Patch

Clearing flags on attachment: 373360

Committed r247078: <https://trac.webkit.org/changeset/247078>
Comment 15 WebKit Commit Bot 2019-07-02 16:07:53 PDT
All reviewed patches have been landed.  Closing bug.
Comment 16 Chris Dumez 2019-07-10 09:44:55 PDT
*** Bug 199657 has been marked as a duplicate of this bug. ***