Regression(r279601) ProcessAssertion may get destroyed on a backgroun…

…d thread https://bugs.webkit.org/show_bug.cgi?id=227875 <rdar://76972252> Reviewed by Geoffrey Garen. r279601 added an internal WorkQueue to ProcessAssertion, so that we could acquire the RunningBoard assertion asynchronously on the background queue. When dispatching to the background queue, we capture |protectedThis|, which means that ProcessAssertion may now get destroyed on the background queue. ProcessAssertion is a main thread object and destroying it on a non-main thread can lead to crashes. * UIProcess/ProcessAssertion.h: * UIProcess/ios/ProcessAssertionIOS.mm: (WebKit::ProcessAssertion::ProcessAssertion): (WebKit::ProcessAssertion::~ProcessAssertion): Canonical link: https://commits.webkit.org/239595@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@279835 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit · Jul 12, 2021 · 2bb6049 · 2bb6049
1 parent 169e752
commit 2bb6049
Show file tree

Hide file tree

Showing 3 changed files with 21 additions and 1 deletion.
diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
@@ -1,3 +1,21 @@
+2021-07-12  Chris Dumez  <cdumez@apple.com>
+
+        Regression(r279601) ProcessAssertion may get destroyed on a background thread
+        https://bugs.webkit.org/show_bug.cgi?id=227875
+        <rdar://76972252>
+
+        Reviewed by Geoffrey Garen.
+
+        r279601 added an internal WorkQueue to ProcessAssertion, so that we could acquire the RunningBoard assertion
+        asynchronously on the background queue. When dispatching to the background queue, we capture |protectedThis|,
+        which means that ProcessAssertion may now get destroyed on the background queue. ProcessAssertion is a main
+        thread object and destroying it on a non-main thread can lead to crashes.
+
+        * UIProcess/ProcessAssertion.h:
+        * UIProcess/ios/ProcessAssertionIOS.mm:
+        (WebKit::ProcessAssertion::ProcessAssertion):
+        (WebKit::ProcessAssertion::~ProcessAssertion):
+
 2021-07-12  Jer Noble  <jer.noble@apple.com>
 
         [Cocoa] Incorrect deprecation declaration for -[WKWebView closeAllMediaPresentations:]

diff --git a/Source/WebKit/UIProcess/ProcessAssertion.h b/Source/WebKit/UIProcess/ProcessAssertion.h
@@ -54,7 +54,7 @@ enum class ProcessAssertionType {
     FinishTaskUninterruptable,
 };
 
-class ProcessAssertion : public ThreadSafeRefCounted<ProcessAssertion>, public CanMakeWeakPtr<ProcessAssertion, WeakPtrFactoryInitialization::Eager> {
+class ProcessAssertion : public ThreadSafeRefCounted<ProcessAssertion, WTF::DestructionThread::MainRunLoop>, public CanMakeWeakPtr<ProcessAssertion, WeakPtrFactoryInitialization::Eager> {
     WTF_MAKE_FAST_ALLOCATED;
 public:
     enum class Mode : bool { Sync, Async };

diff --git a/Source/WebKit/UIProcess/ios/ProcessAssertionIOS.mm b/Source/WebKit/UIProcess/ios/ProcessAssertionIOS.mm
@@ -321,6 +321,7 @@ - (void)assertion:(RBSAssertion *)assertion didInvalidateWithError:(NSError *)er
     , m_pid(pid)
     , m_reason(reason)
 {
+    ASSERT(isMainRunLoop());
     NSString *runningBoardAssertionName = runningBoardNameForAssertionType(assertionType);
     ASSERT(runningBoardAssertionName);
     if (!pid) {
@@ -365,6 +366,7 @@ - (void)assertion:(RBSAssertion *)assertion didInvalidateWithError:(NSError *)er
 
 ProcessAssertion::~ProcessAssertion()
 {
+    ASSERT(isMainRunLoop());
     RELEASE_LOG(ProcessSuspension, "%p - ~ProcessAssertion: Releasing process assertion '%{public}s' for process with PID=%d", this, m_reason.utf8().data(), m_pid);
 
     if (m_rbsAssertion) {