199585 2019-07-08 12:51:55 -0700 Make Document::postTask() safe to call from a background thread 2019-07-08 19:26:21 -0700 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 199517 1 cdumez cdumez achristensen beidson commit-queue dbates esprehn+autocc ews-watchlist kangil.han rniwa webkit-bug-importer youennf oldest_to_newest 1550934 0 cdumez 2019-07-08 12:51:55 -0700 Make Document::postTask() safe to call from a background thread. 1550937 1 373657 cdumez 2019-07-08 12:55:09 -0700 Created attachment 373657 Patch 1550938 2 cdumez 2019-07-08 12:56:16 -0700 Here is an example of legit case where we're calling Document::postTask() from a background thread: Thread 16 Crashed:: WebCore: Worker 0 com.apple.JavaScriptCore 0x000000057173035e WTFCrash + 14 (Assertions.cpp:305) 1 com.apple.WebCore 0x0000000559f463eb WTFCrashWithInfo(int, char const*, char const*, int) + 27 2 com.apple.WebCore 0x000000055b6e114c WebCore::ContainerNode::WeakValueType* WTF::WeakPtrImpl::get<WebCore::ContainerNode>() + 140 (WeakPtr.h:65) 3 com.apple.WebCore 0x000000055b6e0f7a WTF::WeakPtrFactory<WebCore::ContainerNode>::createWeakPtr(WebCore::ContainerNode&) const + 138 (WeakPtr.h:142) 4 com.apple.WebCore 0x000000055b6d70ff WTF::WeakPtr<WebCore::Document> WTF::makeWeakPtr<WebCore::Document>(WebCore::Document&) + 63 (WeakPtr.h:212) 5 com.apple.WebCore 0x000000055c4a21a0 WebCore::Document::postTask(WebCore::ScriptExecutionContext::Task&&) + 32 (Document.cpp:6121) 6 com.apple.WebCore 0x000000055de23635 WebCore::WorkerMessagingProxy::reportPendingActivity(bool) + 101 (WorkerMessagingProxy.cpp:283) 7 com.apple.WebCore 0x000000055de01793 WebCore::DedicatedWorkerThread::runEventLoop() + 83 (DedicatedWorkerThread.cpp:57) 8 com.apple.WebCore 0x000000055de27710 WebCore::WorkerThread::workerThread() + 1184 (WorkerThread.cpp:206) 9 com.apple.WebCore 0x000000055de37c58 WebCore::WorkerThread::start(WTF::Function<void (WTF::String const&)>&&)::$_12::operator()() const + 24 (WorkerThread.cpp:150) 10 com.apple.WebCore 0x000000055de37c19 WTF::Detail::CallableWrapper<WebCore::WorkerThread::start(WTF::Function<void (WTF::String const&)>&&)::$_12, void>::call() + 25 (Function.h:52) 11 com.apple.JavaScriptCore 0x000000057175ad6a WTF::Function<void ()>::operator()() const + 138 (Function.h:79) 12 com.apple.JavaScriptCore 0x00000005717f22f0 WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) + 416 (Threading.cpp:149) 13 com.apple.JavaScriptCore 0x00000005717fa725 WTF::wtfThreadEntryPoint(void*) + 21 (ThreadingPOSIX.cpp:200) 14 libsystem_pthread.dylib 0x00007fff6dd36daa _pthread_start + 125 15 libsystem_pthread.dylib 0x00007fff6dd336af thread_start + 15 1551034 3 373657 achristensen 2019-07-08 16:43:25 -0700 Comment on attachment 373657 Patch Maybe we should add some assertions in makeWeakPtr to make sure it's not called from the wrong thread anywhere else. 1551045 4 cdumez 2019-07-08 16:55:40 -0700 (In reply to Alex Christensen from comment #3) > Comment on attachment 373657 [details] > Patch > > Maybe we should add some assertions in makeWeakPtr to make sure it's not > called from the wrong thread anywhere else. Well, this is what I am doing in Bug 199517, and this is how I found this bug (and several others already). 1551046 5 373657 cdumez 2019-07-08 16:56:49 -0700 Comment on attachment 373657 Patch Clearing flags on attachment: 373657 Committed r247239: <https://trac.webkit.org/changeset/247239> 1551047 6 cdumez 2019-07-08 16:56:51 -0700 All reviewed patches have been landed. Closing bug. 1551048 7 webkit-bug-importer 2019-07-08 16:59:29 -0700 <rdar://problem/52805445> 1551114 8 373657 rniwa 2019-07-08 19:26:21 -0700 Comment on attachment 373657 Patch Nice catch! 373657 2019-07-08 12:55:09 -0700 2019-07-08 16:56:49 -0700 Patch bug-199585-20190708125508.patch text/plain 1841 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjQ3MjI2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNGUxZTI0OTljZmI5YmFj M2UxZDc2NGIzNzQzOGMzODliODRkY2RlMi4uNzhmOGI0YWVhNmQ2ZTljZjYxYzUzMDMyMmRhMjI1 MDUxODAxODdiMyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE4IEBACisyMDE5LTA3LTA4ICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgTWFrZSBEb2N1bWVudDo6cG9z dFRhc2soKSBzYWZlIHRvIGNhbGwgZnJvbSBhIGJhY2tncm91bmQgdGhyZWFkCisgICAgICAgIGh0 dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xOTk1ODUKKworICAgICAgICBS ZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBNYWtlIERvY3VtZW50Ojpwb3N0 VGFzaygpIHNhZmUgdG8gY2FsbCBmcm9tIGEgYmFja2dyb3VuZCB0aHJlYWQgYnkgbm90IGNhbGxp bmcgbWFrZVdlYWtQdHIoKSBvbiB0aGUgRG9jdW1lbnQuCisgICAgICAgIENhbGxpbmcgbWFrZVdl YWtQdHIoKSBvbiBhIGRvY3VtZW50IGZyb20gYSBiYWNrZ3JvdW5kIHRocmVhZCBpcyBub3Qgc2Fm ZSBzaW5jZSBEb2N1bWVudCBpcyBhIG1haW4gdGhyZWFkCisgICAgICAgIG9iamVjdC4gSW5zdGVh ZCwgY2FwdHVyZSBEb2N1bWVudDo6aWRlbnRpZmllcigpIGluIHRoZSBsYW1iZGEgYW5kIGxvb2t1 cCB0aGUgZG9jdW1lbnQgZnJvbSBpdHMgaWRlbnRpZmllcgorICAgICAgICBvbmNlIHdlJ3JlIG9u IHRoZSBtYWluIHRocmVhZC4KKworICAgICAgICAqIGRvbS9Eb2N1bWVudC5jcHA6CisgICAgICAg IChXZWJDb3JlOjpEb2N1bWVudDo6cG9zdFRhc2spOgorCiAyMDE5LTA3LTA4ICBXZW5zb24gSHNp ZWggIDx3ZW5zb25faHNpZWhAYXBwbGUuY29tPgogCiAgICAgICAgIFVuYWJsZSB0byBwYXN0ZSBm cm9tIE5vdGVzIGludG8gRXhjZWwgMzY1IHNwcmVhZHNoZWV0CmRpZmYgLS1naXQgYS9Tb3VyY2Uv V2ViQ29yZS9kb20vRG9jdW1lbnQuY3BwIGIvU291cmNlL1dlYkNvcmUvZG9tL0RvY3VtZW50LmNw cAppbmRleCA1N2FiM2UxNDU0OTVkMjhmOTU4NDFlYWU3NmYyNWUyNzlkNDMxMTAxLi5lY2ExNzc0 OTk5YzA1OTE0NjY4Y2VjMDU5MTY0NjU3ODE0NjBiMTUyIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2Vi Q29yZS9kb20vRG9jdW1lbnQuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2RvbS9Eb2N1bWVudC5j cHAKQEAgLTYxMjAsMTAgKzYxMjAsMTAgQEAgdm9pZCBEb2N1bWVudDo6YWRkTWVzc2FnZShNZXNz YWdlU291cmNlIHNvdXJjZSwgTWVzc2FnZUxldmVsIGxldmVsLCBjb25zdCBTdHJpbmcKIAogdm9p ZCBEb2N1bWVudDo6cG9zdFRhc2soVGFzayYmIHRhc2spCiB7Ci0gICAgY2FsbE9uTWFpblRocmVh ZChbZG9jdW1lbnRSZWZlcmVuY2UgPSBtYWtlV2Vha1B0cigqdGhpcyksIHRhc2sgPSBXVEZNb3Zl KHRhc2spXSgpIG11dGFibGUgeworICAgIGNhbGxPbk1haW5UaHJlYWQoW2RvY3VtZW50SUQgPSBp ZGVudGlmaWVyKCksIHRhc2sgPSBXVEZNb3ZlKHRhc2spXSgpIG11dGFibGUgewogICAgICAgICBB U1NFUlQoaXNNYWluVGhyZWFkKCkpOwogCi0gICAgICAgIERvY3VtZW50KiBkb2N1bWVudCA9IGRv Y3VtZW50UmVmZXJlbmNlLmdldCgpOworICAgICAgICBhdXRvKiBkb2N1bWVudCA9IGFsbERvY3Vt ZW50c01hcCgpLmdldChkb2N1bWVudElEKTsKICAgICAgICAgaWYgKCFkb2N1bWVudCkKICAgICAg ICAgICAgIHJldHVybjsKIAo=