Skip to content

[iOS] CheckedPtr crash under [WebThermalMitigationObserver thermalStateDidChange]#63389

Merged
webkit-commit-queue merged 1 commit into
WebKit:mainfrom
cdumez:313091_WebThermalMitigationObserver
Apr 23, 2026
Merged

[iOS] CheckedPtr crash under [WebThermalMitigationObserver thermalStateDidChange]#63389
webkit-commit-queue merged 1 commit into
WebKit:mainfrom
cdumez:313091_WebThermalMitigationObserver

Conversation

@cdumez
Copy link
Copy Markdown
Contributor

@cdumez cdumez commented Apr 23, 2026

421f42a

[iOS] CheckedPtr crash under [WebThermalMitigationObserver thermalStateDidChange]
https://bugs.webkit.org/show_bug.cgi?id=313091
rdar://170616981

Reviewed by Ryosuke Niwa.

Make ThermalMitigationNotifier ref-counted instead of CanMakeCheckedPtr
and protect this in `[WebThermalMitigationObserver thermalStateDidChange]`
before calling notifyThermalMitigationChanged() on it.

* Source/WebCore/page/Page.cpp:
(WebCore::m_thermalMitigationNotifier):
* Source/WebCore/page/Page.h:
* Source/WebCore/platform/ThermalMitigationNotifier.cpp:
(WebCore::ThermalMitigationNotifier::create):
* Source/WebCore/platform/ThermalMitigationNotifier.h:
* Source/WebCore/platform/cocoa/ThermalMitigationNotifier.mm:
(-[WebThermalMitigationObserver thermalStateDidChange]):
* Source/WebKit/NetworkProcess/cache/NetworkCache.cpp:
(WebKit::NetworkCache::Cache::Cache):
* Source/WebKit/NetworkProcess/cache/NetworkCache.h:

Canonical link: https://commits.webkit.org/311843@main

43774df

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows Apple Internal
❌ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe 🛠 win ⏳ 🛠 ios-apple
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ✅ 🧪 wpe-wk2 🧪 win-tests ⏳ 🛠 mac-apple
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 🧪 api-mac ✅ 🧪 api-wpe ⏳ 🛠 vision-apple
🧪 ios-wk2-wpt 🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
🧪 api-ios ✅ 🧪 mac-wk1 ✅ 🛠 gtk
✅ 🛠 ios-safer-cpp ✅ 🧪 mac-wk2 ✅ 🧪 gtk-wk2
✅ 🛠 vision 🧪 mac-AS-debug-wk2 ✅ 🧪 api-gtk
✅ 🛠 🧪 merge ✅ 🛠 vision-sim ✅ 🧪 mac-wk2-stress ✅ 🛠 playstation
✅ 🧪 vision-wk2 🧪 mac-intel-wk2
✅ 🛠 tv ✅ 🛠 mac-safer-cpp
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@cdumez cdumez self-assigned this Apr 23, 2026
@cdumez cdumez added the WebKit2 Bugs relating to the WebKit2 API layer label Apr 23, 2026
@cdumez cdumez requested review from bnham, geoffreygaren and rniwa April 23, 2026 02:52
@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Apr 23, 2026
Comment thread Source/WebCore/page/Page.cpp Outdated
@@ -444,7 +444,7 @@ Page::Page(PageConfiguration&& pageConfiguration)
, m_isUtilityPage(isUtilityPageChromeClient(chrome().client()))
, m_performanceMonitor(isUtilityPage() ? nullptr : makeUniqueWithoutRefCountedCheck<PerformanceMonitor>(*this))
, m_lowPowerModeNotifier(makeUniqueRef<LowPowerModeNotifier>([this](bool isLowPowerModeEnabled) { handleLowPowerModeChange(isLowPowerModeEnabled); }))
, m_thermalMitigationNotifier(makeUniqueRef<ThermalMitigationNotifier>([this](bool thermalMitigationEnabled) { handleThermalMitigationChange(thermalMitigationEnabled); }))
, m_thermalMitigationNotifier(ThermalMitigationNotifier::create([weakThis = WeakPtr { *this }](bool thermalMitigationEnabled) { if (RefPtr protectedThis = weakThis) protectedThis->handleThermalMitigationChange(thermalMitigationEnabled); }))
Copy link
Copy Markdown
Member

@rniwa rniwa Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are so many parentheses / brackets here that it's hard to follow.
Can we insert line breaks?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will do.

@cdumez cdumez removed the merging-blocked Applied to prevent a change from being merged label Apr 23, 2026
@cdumez cdumez force-pushed the 313091_WebThermalMitigationObserver branch from 7eb007f to 43774df Compare April 23, 2026 09:12
@cdumez cdumez added the merge-queue Applied to send a pull request to merge-queue label Apr 23, 2026
…teDidChange]

https://bugs.webkit.org/show_bug.cgi?id=313091
rdar://170616981

Reviewed by Ryosuke Niwa.

Make ThermalMitigationNotifier ref-counted instead of CanMakeCheckedPtr
and protect this in `[WebThermalMitigationObserver thermalStateDidChange]`
before calling notifyThermalMitigationChanged() on it.

* Source/WebCore/page/Page.cpp:
(WebCore::m_thermalMitigationNotifier):
* Source/WebCore/page/Page.h:
* Source/WebCore/platform/ThermalMitigationNotifier.cpp:
(WebCore::ThermalMitigationNotifier::create):
* Source/WebCore/platform/ThermalMitigationNotifier.h:
* Source/WebCore/platform/cocoa/ThermalMitigationNotifier.mm:
(-[WebThermalMitigationObserver thermalStateDidChange]):
* Source/WebKit/NetworkProcess/cache/NetworkCache.cpp:
(WebKit::NetworkCache::Cache::Cache):
* Source/WebKit/NetworkProcess/cache/NetworkCache.h:

Canonical link: https://commits.webkit.org/311843@main
@webkit-commit-queue webkit-commit-queue force-pushed the 313091_WebThermalMitigationObserver branch from 43774df to 421f42a Compare April 23, 2026 10:28
@webkit-commit-queue
Copy link
Copy Markdown
Collaborator

Committed 311843@main (421f42a): https://commits.webkit.org/311843@main

Reviewed commits have been landed. Closing PR #63389 and removing active labels.

@webkit-commit-queue webkit-commit-queue merged commit 421f42a into WebKit:main Apr 23, 2026
@webkit-commit-queue webkit-commit-queue removed the merge-queue Applied to send a pull request to merge-queue label Apr 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

WebKit2 Bugs relating to the WebKit2 API layer

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants