[webkit-changes] [WebKit/WebKit] 73c65f: Crash under Connection::enqueueIncomingMessage() d...

[Chris Dumez]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 73c65f7bc1821f1f76b08a19fe11ebe54e833050
      https://github.com/WebKit/WebKit/commit/73c65f7bc1821f1f76b08a19fe11ebe54e833050
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2024-08-05 (Mon, 05 Aug 2024)

  Changed paths:
    M Source/WebKit/Platform/IPC/Connection.cpp
    M Source/WebKit/Platform/IPC/Connection.h

  Log Message:
  -----------
  Crash under Connection::enqueueIncomingMessage() due to recursive locking
https://bugs.webkit.org/show_bug.cgi?id=277650
rdar://133167925

Reviewed by Per Arne Vollan.

enqueueIncomingMessage() is called while holding the m_incomingMessagesLock lock. Then it calls
dispatchToClient() in case of IPC message throttling and dispatchToClient() tries to acquire
the same lock, thus the recursive locking.

m_incomingMessagesLock used to be a WTF::Lock, which apparently didn’t mind recursive locking.
However, we’ve recently made the switch to unfair_lock for responsiveness reasons and it
asserts when recursive locking.

To address the issue, make sure we don't recursive lock anymore and add compiler annotations
to catch such logic bugs at compile time.

* Source/WebKit/Platform/IPC/Connection.cpp:
(IPC::Connection::enqueueIncomingMessage):
(IPC::Connection::dispatchToClient):
(IPC::Connection::dispatchToClientWithIncomingMessagesLock):
* Source/WebKit/Platform/IPC/Connection.h:

Canonical link: https://commits.webkit.org/281862@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications