Title: [264119] trunk/Source/WebKit
- Revision
- 264119
- Author
- [email protected]
- Date
- 2020-07-08 11:15:07 -0700 (Wed, 08 Jul 2020)
Log Message
Network process crashes in WebKit::WebIDBServer::removeConnection
https://bugs.webkit.org/show_bug.cgi?id=214071
<rdar://problem/64853929>
Patch by Sihui Liu <[email protected]> on 2020-07-08
Reviewed by Chris Dumez.
In network process, WebIDBServer may be removed and destroyed before web process using the same session
disconnects. Then a new WebIDBServer can be added before disconnection of web process and the new WebIDBServer
does not have information about the web process connection.
To solve this issue, now we only remove WebIDBServer when session is destroyed and there is no web process
connection of that session.
* NetworkProcess/IndexedDB/WebIDBServer.h:
* NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::createNetworkConnectionToWebProcess):
(WebKit::NetworkProcess::destroySession):
(WebKit::NetworkProcess::removeWebIDBServerIfPossible):
(WebKit::NetworkProcess::connectionToWebProcessClosed):
* NetworkProcess/NetworkProcess.h:
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (264118 => 264119)
--- trunk/Source/WebKit/ChangeLog 2020-07-08 18:03:21 UTC (rev 264118)
+++ trunk/Source/WebKit/ChangeLog 2020-07-08 18:15:07 UTC (rev 264119)
@@ -1,3 +1,26 @@
+2020-07-08 Sihui Liu <[email protected]>
+
+ Network process crashes in WebKit::WebIDBServer::removeConnection
+ https://bugs.webkit.org/show_bug.cgi?id=214071
+ <rdar://problem/64853929>
+
+ Reviewed by Chris Dumez.
+
+ In network process, WebIDBServer may be removed and destroyed before web process using the same session
+ disconnects. Then a new WebIDBServer can be added before disconnection of web process and the new WebIDBServer
+ does not have information about the web process connection.
+
+ To solve this issue, now we only remove WebIDBServer when session is destroyed and there is no web process
+ connection of that session.
+
+ * NetworkProcess/IndexedDB/WebIDBServer.h:
+ * NetworkProcess/NetworkProcess.cpp:
+ (WebKit::NetworkProcess::createNetworkConnectionToWebProcess):
+ (WebKit::NetworkProcess::destroySession):
+ (WebKit::NetworkProcess::removeWebIDBServerIfPossible):
+ (WebKit::NetworkProcess::connectionToWebProcessClosed):
+ * NetworkProcess/NetworkProcess.h:
+
2020-07-08 Andy Estes <[email protected]>
REGRESSION (r207558): [Mac] Context clicks on links sometimes result in navigations
Modified: trunk/Source/WebKit/NetworkProcess/IndexedDB/WebIDBServer.h (264118 => 264119)
--- trunk/Source/WebKit/NetworkProcess/IndexedDB/WebIDBServer.h 2020-07-08 18:03:21 UTC (rev 264118)
+++ trunk/Source/WebKit/NetworkProcess/IndexedDB/WebIDBServer.h 2020-07-08 18:15:07 UTC (rev 264119)
@@ -89,6 +89,7 @@
void dispatchToThread(WTF::Function<void()>&&);
void close();
+ bool hasConnection() const { return !m_connections.isEmpty(); }
private:
WebIDBServer(PAL::SessionID, const String& directory, WebCore::IDBServer::IDBServer::StorageQuotaManagerSpaceRequester&&);
~WebIDBServer();
Modified: trunk/Source/WebKit/NetworkProcess/NetworkProcess.cpp (264118 => 264119)
--- trunk/Source/WebKit/NetworkProcess/NetworkProcess.cpp 2020-07-08 18:03:21 UTC (rev 264118)
+++ trunk/Source/WebKit/NetworkProcess/NetworkProcess.cpp 2020-07-08 18:15:07 UTC (rev 264119)
@@ -415,7 +415,9 @@
m_storageManagerSet->addConnection(connection.connection());
+#if ENABLE(INDEXED_DATABASE)
webIDBServer(sessionID).addConnection(connection.connection(), identifier);
+#endif
}
void NetworkProcess::clearCachedCredentials()
@@ -596,8 +598,10 @@
#endif
m_storageManagerSet->remove(sessionID);
- if (auto webIDBServer = m_webIDBServers.take(sessionID))
- webIDBServer->close();
+
+#if ENABLE(INDEXED_DATABASE)
+ removeWebIDBServerIfPossible(sessionID);
+#endif
}
#if ENABLE(RESOURCE_LOAD_STATISTICS)
@@ -2506,6 +2510,24 @@
sessionStorageQuotaManager->setIDBRootPath(idbRootPath);
}
+void NetworkProcess::removeWebIDBServerIfPossible(PAL::SessionID sessionID)
+{
+ ASSERT(RunLoop::isMain());
+
+ auto iterator = m_webIDBServers.find(sessionID);
+ if (iterator == m_webIDBServers.end())
+ return;
+
+ if (m_networkSessions.contains(sessionID))
+ return;
+
+ if (iterator->value->hasConnection())
+ return;
+
+ iterator->value->close();
+ m_webIDBServers.remove(iterator);
+}
+
#endif // ENABLE(INDEXED_DATABASE)
void NetworkProcess::syncLocalStorage(CompletionHandler<void()>&& completionHandler)
@@ -2737,8 +2759,13 @@
void NetworkProcess::connectionToWebProcessClosed(IPC::Connection& connection, PAL::SessionID sessionID)
{
m_storageManagerSet->removeConnection(connection);
- if (auto* webIDBServer = m_webIDBServers.get(sessionID))
- webIDBServer->removeConnection(connection);
+
+#if ENABLE(INDEXED_DATABASE)
+ auto* webIDBServer = m_webIDBServers.get(sessionID);
+ ASSERT(webIDBServer);
+ webIDBServer->removeConnection(connection);
+ removeWebIDBServerIfPossible(sessionID);
+#endif
}
NetworkConnectionToWebProcess* NetworkProcess::webProcessConnection(ProcessIdentifier identifier) const
Modified: trunk/Source/WebKit/NetworkProcess/NetworkProcess.h (264118 => 264119)
--- trunk/Source/WebKit/NetworkProcess/NetworkProcess.h 2020-07-08 18:03:21 UTC (rev 264118)
+++ trunk/Source/WebKit/NetworkProcess/NetworkProcess.h 2020-07-08 18:15:07 UTC (rev 264119)
@@ -463,6 +463,7 @@
HashSet<WebCore::SecurityOriginData> indexedDatabaseOrigins(const String& path);
Ref<WebIDBServer> createWebIDBServer(PAL::SessionID);
void setSessionStorageQuotaManagerIDBRootPath(PAL::SessionID, const String& idbRootPath);
+ void removeWebIDBServerIfPossible(PAL::SessionID);
#endif
#if ENABLE(SERVICE_WORKER)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
