ASSERTION FAILED: !m_processes[i] || *m_processes[i] == process in Me…

…ssagePortChannel::entanglePortWithProcess()

https://bugs.webkit.org/show_bug.cgi?id=182054
<rdar://problem/36871207>

Reviewed by Brady Eidson.

Pipe postMessage messages to and from service workers via the UIProcess instead of going
directly to the StorageProcess. This is temporarily needed to avoid races due to the
MessagePort registry currently living in the UIProcess and postMessage messages potentially
sending MessagePort objects.

This change is covered by tests on the bots that currently flakily crash in debug.

* StorageProcess/ServiceWorker/WebSWServerConnection.h:
* StorageProcess/StorageProcess.cpp:
(WebKit::StorageProcess::postMessageToServiceWorker):
* StorageProcess/StorageProcess.h:
* StorageProcess/StorageProcess.messages.in:
* UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::postMessageToServiceWorkerClient):
(WebKit::WebProcessPool::postMessageToServiceWorker):
* UIProcess/WebProcessPool.h:
* UIProcess/WebProcessPool.messages.in:
* WebProcess/Storage/WebSWClientConnection.cpp:
(WebKit::WebSWClientConnection::postMessageToServiceWorker):
* WebProcess/Storage/WebSWContextManagerConnection.cpp:
(WebKit::WebSWContextManagerConnection::postMessageToServiceWorkerClient):


Canonical link: https://commits.webkit.org/198628@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@228564 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebKit/ChangeLog

@@ -1,3 +1,33 @@
+2018-02-16  Chris Dumez  <cdumez@apple.com>
+
+        ASSERTION FAILED: !m_processes[i] || *m_processes[i] == process in MessagePortChannel::entanglePortWithProcess()
+        https://bugs.webkit.org/show_bug.cgi?id=182054
+        <rdar://problem/36871207>
+
+        Reviewed by Brady Eidson.
+
+        Pipe postMessage messages to and from service workers via the UIProcess instead of going
+        directly to the StorageProcess. This is temporarily needed to avoid races due to the
+        MessagePort registry currently living in the UIProcess and postMessage messages potentially
+        sending MessagePort objects.
+
+        This change is covered by tests on the bots that currently flakily crash in debug.
+
+        * StorageProcess/ServiceWorker/WebSWServerConnection.h:
+        * StorageProcess/StorageProcess.cpp:
+        (WebKit::StorageProcess::postMessageToServiceWorker):
+        * StorageProcess/StorageProcess.h:
+        * StorageProcess/StorageProcess.messages.in:
+        * UIProcess/WebProcessPool.cpp:
+        (WebKit::WebProcessPool::postMessageToServiceWorkerClient):
+        (WebKit::WebProcessPool::postMessageToServiceWorker):
+        * UIProcess/WebProcessPool.h:
+        * UIProcess/WebProcessPool.messages.in:
+        * WebProcess/Storage/WebSWClientConnection.cpp:
+        (WebKit::WebSWClientConnection::postMessageToServiceWorker):
+        * WebProcess/Storage/WebSWContextManagerConnection.cpp:
+        (WebKit::WebSWContextManagerConnection::postMessageToServiceWorkerClient):
+
 2018-02-16  Wenson Hsieh  <wenson_hsieh@apple.com>
 
         [Extra zoom mode] Add basic support for <input type='date'> using date picker UI

Source/WebKit/StorageProcess/ServiceWorker/WebSWServerConnection.h

@@ -69,6 +69,7 @@ class WebSWServerConnection : public WebCore::SWServer::Connection, public IPC::
     void didNotHandleFetch(uint64_t fetchIdentifier);
 
     void postMessageToServiceWorkerClient(WebCore::DocumentIdentifier destinationContextIdentifier, WebCore::MessageWithMessagePorts&&, WebCore::ServiceWorkerIdentifier sourceServiceWorkerIdentifier, const String& sourceOrigin);
+    void postMessageToServiceWorker(WebCore::ServiceWorkerIdentifier destination, WebCore::MessageWithMessagePorts&&, const WebCore::ServiceWorkerOrClientIdentifier& source);
 
 private:
     // Implement SWServer::Connection (Messages to the client WebProcess)
@@ -88,8 +89,6 @@ class WebSWServerConnection : public WebCore::SWServer::Connection, public IPC::
 
     void startFetch(uint64_t fetchIdentifier, WebCore::ServiceWorkerRegistrationIdentifier, WebCore::ResourceRequest&&, WebCore::FetchOptions&&, IPC::FormDataReference&&, String&& referrer);
 
-    void postMessageToServiceWorker(WebCore::ServiceWorkerIdentifier destination, WebCore::MessageWithMessagePorts&&, const WebCore::ServiceWorkerOrClientIdentifier& source);
-
     void matchRegistration(uint64_t registrationMatchRequestIdentifier, const WebCore::SecurityOriginData& topOrigin, const WebCore::URL& clientURL);
     void getRegistrations(uint64_t registrationMatchRequestIdentifier, const WebCore::SecurityOriginData& topOrigin, const WebCore::URL& clientURL);
 

Source/WebKit/StorageProcess/StorageProcess.cpp

@@ -484,6 +484,12 @@ void StorageProcess::postMessageToServiceWorkerClient(const ServiceWorkerClientI
         connection->postMessageToServiceWorkerClient(destinationIdentifier.contextIdentifier, WTFMove(message), sourceIdentifier, sourceOrigin);
 }
 
+void StorageProcess::postMessageToServiceWorker(WebCore::ServiceWorkerIdentifier destination, WebCore::MessageWithMessagePorts&& message, const WebCore::ServiceWorkerOrClientIdentifier& source, SWServerConnectionIdentifier connectionIdentifier)
+{
+    if (auto* connection = m_swServerConnections.get(connectionIdentifier))
+        connection->postMessageToServiceWorker(destination, WTFMove(message), source);
+}
+
 void StorageProcess::registerSWServerConnection(WebSWServerConnection& connection)
 {
     ASSERT(!m_swServerConnections.contains(connection.identifier()));

Source/WebKit/StorageProcess/StorageProcess.h

@@ -137,6 +137,8 @@ class StorageProcess : public ChildProcess
     void didNotHandleFetch(WebCore::SWServerConnectionIdentifier, uint64_t fetchIdentifier);
 
     void postMessageToServiceWorkerClient(const WebCore::ServiceWorkerClientIdentifier& destinationIdentifier, WebCore::MessageWithMessagePorts&&, WebCore::ServiceWorkerIdentifier sourceIdentifier, const String& sourceOrigin);
+    void postMessageToServiceWorker(WebCore::ServiceWorkerIdentifier destination, WebCore::MessageWithMessagePorts&&, const WebCore::ServiceWorkerOrClientIdentifier& source, WebCore::SWServerConnectionIdentifier);
+
     WebSWOriginStore& swOriginStoreForSession(PAL::SessionID);
     bool needsServerToContextConnection() const;
 #endif

Source/WebKit/StorageProcess/StorageProcess.messages.in

@@ -43,5 +43,7 @@ messages -> StorageProcess LegacyReceiver {
     DidReceiveFetchFormData(WebCore::SWServerConnectionIdentifier serverConnectionIdentifier, uint64_t fetchIdentifier, IPC::FormDataReference data)
     DidFinishFetch(WebCore::SWServerConnectionIdentifier serverConnectionIdentifier, uint64_t fetchIdentifier)
     PostMessageToServiceWorkerClient(struct WebCore::ServiceWorkerClientIdentifier destinationIdentifier, struct WebCore::MessageWithMessagePorts message, WebCore::ServiceWorkerIdentifier sourceIdentifier, String sourceOrigin)
+
+    PostMessageToServiceWorker(WebCore::ServiceWorkerIdentifier destination, struct WebCore::MessageWithMessagePorts message, WebCore::ServiceWorkerOrClientIdentifier source, WebCore::SWServerConnectionIdentifier connectionIdentifier)
 #endif
 }

Source/WebKit/UIProcess/WebProcessPool.cpp

@@ -1842,6 +1842,18 @@ void WebProcessPool::updateProcessAssertions()
 #endif
 }
 
+#if ENABLE(SERVICE_WORKER)
+void WebProcessPool::postMessageToServiceWorkerClient(const ServiceWorkerClientIdentifier& destination, MessageWithMessagePorts&& message, ServiceWorkerIdentifier source, const String& sourceOrigin)
+{
+    sendToStorageProcessRelaunchingIfNecessary(Messages::StorageProcess::PostMessageToServiceWorkerClient(destination, WTFMove(message), source, sourceOrigin));
+}
+
+void WebProcessPool::postMessageToServiceWorker(ServiceWorkerIdentifier destination, MessageWithMessagePorts&& message, const ServiceWorkerOrClientIdentifier& source, SWServerConnectionIdentifier connectionIdentifier)
+{
+    sendToStorageProcessRelaunchingIfNecessary(Messages::StorageProcess::PostMessageToServiceWorker(destination, WTFMove(message), source, connectionIdentifier));
+}
+#endif
+
 void WebProcessPool::reinstateNetworkProcessAssertionState(NetworkProcessProxy& newNetworkProcessProxy)
 {
 #if PLATFORM(IOS)

Source/WebKit/UIProcess/WebProcessPool.h

@@ -425,6 +425,11 @@ class WebProcessPool final : public API::ObjectImpl<API::Object::Type::ProcessPo
     void setStorageAccessAPIEnabled(bool);
 #endif
 
+#if ENABLE(SERVICE_WORKER)
+    void postMessageToServiceWorkerClient(const WebCore::ServiceWorkerClientIdentifier& destinationIdentifier, WebCore::MessageWithMessagePorts&&, WebCore::ServiceWorkerIdentifier sourceIdentifier, const String& sourceOrigin);
+    void postMessageToServiceWorker(WebCore::ServiceWorkerIdentifier destination, WebCore::MessageWithMessagePorts&&, const WebCore::ServiceWorkerOrClientIdentifier& source, WebCore::SWServerConnectionIdentifier);
+#endif
+
     static uint64_t registerProcessPoolCreationListener(Function<void(WebProcessPool&)>&&);
     static void unregisterProcessPoolCreationListener(uint64_t identifier);
 

Source/WebKit/UIProcess/WebProcessPool.messages.in

@@ -36,4 +36,9 @@ messages -> WebProcessPool {
     void PlugInDidReceiveUserInteraction(uint32_t hash, PAL::SessionID sessionID)
 
     ReportWebContentCPUTime(Seconds cpuTime, uint64_t activityState)
+
+#if ENABLE(SERVICE_WORKER)
+    PostMessageToServiceWorkerClient(struct WebCore::ServiceWorkerClientIdentifier destinationIdentifier, struct WebCore::MessageWithMessagePorts message, WebCore::ServiceWorkerIdentifier sourceIdentifier, String sourceOrigin)
+    PostMessageToServiceWorker(WebCore::ServiceWorkerIdentifier destination, struct WebCore::MessageWithMessagePorts message, WebCore::ServiceWorkerOrClientIdentifier source, WebCore::SWServerConnectionIdentifier connectionIdentifier)
+#endif
 }

Source/WebKit/WebProcess/Storage/WebSWClientConnection.cpp

@@ -34,6 +34,8 @@
 #include "ServiceWorkerClientFetch.h"
 #include "StorageToWebProcessConnectionMessages.h"
 #include "WebCoreArgumentCoders.h"
+#include "WebProcess.h"
+#include "WebProcessPoolMessages.h"
 #include "WebSWOriginTable.h"
 #include "WebSWServerConnectionMessages.h"
 #include <WebCore/Document.h>
@@ -85,7 +87,9 @@ void WebSWClientConnection::removeServiceWorkerRegistrationInServer(ServiceWorke
 
 void WebSWClientConnection::postMessageToServiceWorker(ServiceWorkerIdentifier destinationIdentifier, MessageWithMessagePorts&& message, const ServiceWorkerOrClientIdentifier& sourceIdentifier)
 {
-    send(Messages::WebSWServerConnection::PostMessageToServiceWorker(destinationIdentifier, WTFMove(message), sourceIdentifier) );
+    // FIXME: Temporarily pipe the SW postMessage messages via the UIProcess since this is where the MessagePort registry lives
+    // and this avoids races.
+    WebProcess::singleton().send(Messages::WebProcessPool::PostMessageToServiceWorker(destinationIdentifier, WTFMove(message), sourceIdentifier, serverConnectionIdentifier()), 0);
 }
 
 void WebSWClientConnection::registerServiceWorkerClient(const SecurityOrigin& topOrigin, const WebCore::ServiceWorkerClientData& data, const std::optional<WebCore::ServiceWorkerIdentifier>& controllingServiceWorkerIdentifier)

Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.cpp

@@ -39,6 +39,7 @@
 #include "WebPreferencesKeys.h"
 #include "WebPreferencesStore.h"
 #include "WebProcess.h"
+#include "WebProcessPoolMessages.h"
 #include "WebSWServerToContextConnectionMessages.h"
 #include "WebServiceWorkerFetchTaskClient.h"
 #include "WebSocketProvider.h"
@@ -219,7 +220,9 @@ void WebSWContextManagerConnection::syncTerminateWorker(ServiceWorkerIdentifier
 
 void WebSWContextManagerConnection::postMessageToServiceWorkerClient(const ServiceWorkerClientIdentifier& destinationIdentifier, MessageWithMessagePorts&& message, ServiceWorkerIdentifier sourceIdentifier, const String& sourceOrigin)
 {
-    m_connectionToStorageProcess->send(Messages::StorageProcess::PostMessageToServiceWorkerClient(destinationIdentifier, WTFMove(message), sourceIdentifier, sourceOrigin), 0);
+    // FIXME: Temporarily pipe the SW postMessage messages via the UIProcess since this is where the MessagePort registry lives
+    // and this avoids races.
+    WebProcess::singleton().send(Messages::WebProcessPool::PostMessageToServiceWorkerClient(destinationIdentifier, WTFMove(message), sourceIdentifier, sourceOrigin), 0);
 }
 
 void WebSWContextManagerConnection::didFinishInstall(std::optional<ServiceWorkerJobDataIdentifier> jobDataIdentifier, ServiceWorkerIdentifier serviceWorkerIdentifier, bool wasSuccessful)