Bug 227103 - Clear state after process crash so that we know to re-issue sandbox extensions
Summary: Clear state after process crash so that we know to re-issue sandbox extensions
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit2 (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Brent Fulgham
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2021-06-16 17:11 PDT by Brent Fulgham
Modified: 2021-06-18 13:36 PDT (History)
5 users (show)

See Also:


Attachments
Patch (2.13 KB, patch)
2021-06-16 17:17 PDT, Brent Fulgham
no flags Details | Formatted Diff | Diff
Patch (3.27 KB, patch)
2021-06-17 17:16 PDT, Brent Fulgham
no flags Details | Formatted Diff | Diff
Patch for landing (2.31 KB, patch)
2021-06-18 12:52 PDT, Brent Fulgham
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Brent Fulgham 2021-06-16 17:11:43 PDT
We dynamically extend access to certain mach services when the ATTACHMENT_ELEMENT feature is enabled. If a process with this feature activated crashes and WebKit relaunches it, we don't grant the new process the same extensions because we believe they were already previously sent.

This patch clears the state after a process crash so that it properly handles the restart case.
Comment 1 Brent Fulgham 2021-06-16 17:12:18 PDT
<rdar://problem/77588760>
Comment 2 Brent Fulgham 2021-06-16 17:17:09 PDT
Created attachment 431624 [details]
Patch
Comment 3 Per Arne Vollan 2021-06-17 00:55:29 PDT
Comment on attachment 431624 [details]
Patch

R=me.
Comment 4 EWS 2021-06-17 15:14:24 PDT
Committed r279014 (238939@main): <https://commits.webkit.org/238939@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 431624 [details].
Comment 5 Brent Fulgham 2021-06-17 17:16:22 PDT
Reopening to attach new patch.
Comment 6 Brent Fulgham 2021-06-17 17:16:23 PDT
Created attachment 431745 [details]
Patch
Comment 7 Tim Horton 2021-06-17 17:25:49 PDT
Comment on attachment 431745 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=431745&action=review

> Source/WebKit/UIProcess/WebPageProxy.cpp:8201
> -    if (m_preferences->attachmentElementEnabled() && !m_process->hasIssuedAttachmentElementRelatedSandboxExtensions()) {
> +    if (m_preferences->attachmentElementEnabled() && !process.hasIssuedAttachmentElementRelatedSandboxExtensions()) {

There's other code that uses m_process in this function... is it wrong too??
Comment 8 Brent Fulgham 2021-06-17 23:28:56 PDT
(In reply to Tim Horton from comment #7)
> Comment on attachment 431745 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=431745&action=review
> 
> > Source/WebKit/UIProcess/WebPageProxy.cpp:8201
> > -    if (m_preferences->attachmentElementEnabled() && !m_process->hasIssuedAttachmentElementRelatedSandboxExtensions()) {
> > +    if (m_preferences->attachmentElementEnabled() && !process.hasIssuedAttachmentElementRelatedSandboxExtensions()) {
> 
> There's other code that uses m_process in this function... is it wrong too??

Probably? I’ll take a look….
Comment 9 Brent Fulgham 2021-06-18 12:52:40 PDT
Created attachment 431784 [details]
Patch for landing
Comment 10 Brent Fulgham 2021-06-18 12:53:48 PDT
(In reply to Brent Fulgham from comment #8)
> (In reply to Tim Horton from comment #7)
> > Comment on attachment 431745 [details]
> > Patch
> > 
> > View in context:
> > https://bugs.webkit.org/attachment.cgi?id=431745&action=review
> > 
> > > Source/WebKit/UIProcess/WebPageProxy.cpp:8201
> > > -    if (m_preferences->attachmentElementEnabled() && !m_process->hasIssuedAttachmentElementRelatedSandboxExtensions()) {
> > > +    if (m_preferences->attachmentElementEnabled() && !process.hasIssuedAttachmentElementRelatedSandboxExtensions()) {
> > 
> > There's other code that uses m_process in this function... is it wrong too??
> 
> Probably? I’ll take a look….

The only other instance I saw was this one:

    parameters.shouldCaptureDisplayInUIProcess = m_process->processPool().configuration().shouldCaptureDisplayInUIProcess();

I didn't change it because I wanted to check with GPU Process people. I suspect its fine as-is, since they are likely using the same process pool. I wasn't sure if the state about capturing display in the UI Process would be correct in the new process yet, either.
Comment 11 EWS 2021-06-18 13:36:45 PDT
Committed r279045 (238965@main): <https://commits.webkit.org/238965@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 431784 [details].