Attachment 420683 Details for Bug 222056 – Patch

[patch] Patch

bug-222056-20210217212421.patch (text/plain), 4.14 KB, created by Kimmo Kinnunen on 2021-02-17 11:24:22 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Kimmo Kinnunen

Created: 2021-02-17 11:24:22 PST

Size: 4.14 KB

patch

obsolete

>Subversion Revision: 273013
>diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
>index de822ee493bce829bbf0a2e542c178103ab4500d..1f0580cce1f3f784f45a4b01de77c271e91ebc90 100644
>--- a/Source/WebKit/ChangeLog
>+++ b/Source/WebKit/ChangeLog
>@@ -1,3 +1,29 @@
>+2021-02-17  Kimmo Kinnunen  <kkinnunen@apple.com>
>+
>+        RemoteRenderingBackend is accessed in non-thread-safe manner
>+        https://bugs.webkit.org/show_bug.cgi?id=222056
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        The class calls Connection::addWorkQueueMessageReceiver() during its
>+        construction, passing 'this' as the receiver.
>+
>+        The virtual function pointer is not fully constructed during the call time.
>+        Connection may start dispatching calls to the work queue. The work queue may
>+        dispatch the task function through that pointer immediately after the call. If a
>+        message comes during the constructor call, it may be dispatched during the
>+        constructor still running, before the virtual function pointer being correctly
>+        set up. Accessing virtual function pointer is not thread safe until it is fully
>+        constructed.
>+
>+        No new tests, unit tests for WebKit not possible ATM.
>+
>+        * GPUProcess/graphics/RemoteRenderingBackend.cpp:
>+        (WebKit::RemoteRenderingBackend::create):
>+        (WebKit::RemoteRenderingBackend::RemoteRenderingBackend):
>+        (WebKit::RemoteRenderingBackend::startListeningForIPC):
>+        * GPUProcess/graphics/RemoteRenderingBackend.h:
>+
> 2021-02-17  Megan Gardner  <megan_gardner@apple.com>
> 
>         Change App Highlight delegate to pass more information about the highlight for display.
>diff --git a/Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp b/Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp
>index 2c7625186aee15d772b764bdd559f0a1c270bd41..99013d47fb42b0188caa9d4ac947beef90f5cfa6 100644
>--- a/Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp
>+++ b/Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp
>@@ -64,7 +64,9 @@ using namespace WebCore;
> 
> Ref<RemoteRenderingBackend> RemoteRenderingBackend::create(GPUConnectionToWebProcess& gpuConnectionToWebProcess, RenderingBackendIdentifier identifier, IPC::Semaphore&& resumeDisplayListSemaphore)
> {
>-    return adoptRef(*new RemoteRenderingBackend(gpuConnectionToWebProcess, identifier, WTFMove(resumeDisplayListSemaphore)));
>+    auto instance = adoptRef(*new RemoteRenderingBackend(gpuConnectionToWebProcess, identifier, WTFMove(resumeDisplayListSemaphore)));
>+    instance->startListeningForIPC();
>+    return instance;
> }
> 
> RemoteRenderingBackend::RemoteRenderingBackend(GPUConnectionToWebProcess& gpuConnectionToWebProcess, RenderingBackendIdentifier identifier, IPC::Semaphore&& resumeDisplayListSemaphore)
>@@ -74,7 +76,11 @@ RemoteRenderingBackend::RemoteRenderingBackend(GPUConnectionToWebProcess& gpuCon
>     , m_resumeDisplayListSemaphore(WTFMove(resumeDisplayListSemaphore))
> {
>     ASSERT(RunLoop::isMain());
>-    gpuConnectionToWebProcess.connection().addWorkQueueMessageReceiver(Messages::RemoteRenderingBackend::messageReceiverName(), m_workQueue, this, m_renderingBackendIdentifier.toUInt64());
>+}
>+
>+void RemoteRenderingBackend::startListeningForIPC()
>+{
>+    m_gpuConnectionToWebProcess->connection().addWorkQueueMessageReceiver(Messages::RemoteRenderingBackend::messageReceiverName(), m_workQueue, this, m_renderingBackendIdentifier.toUInt64());
> }
> 
> RemoteRenderingBackend::~RemoteRenderingBackend()
>diff --git a/Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.h b/Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.h
>index b7aee2627705bb9acc1019d7155ef27e153d2b28..167a7f13deb26d189867ba637b372b915d4f047b 100644
>--- a/Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.h
>+++ b/Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.h
>@@ -82,6 +82,7 @@ public:
> 
> private:
>     RemoteRenderingBackend(GPUConnectionToWebProcess&, RenderingBackendIdentifier, IPC::Semaphore&&);
>+    void startListeningForIPC();
> 
>     Optional<WebCore::DisplayList::ItemHandle> WARN_UNUSED_RETURN decodeItem(const uint8_t* data, size_t length, WebCore::DisplayList::ItemType, uint8_t* handleLocation) override;
>

Actions: View | Formatted Diff | Diff

Attachments on bug 222056: 420674 | 420683