Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c2562ee994064554fd397a4b23345ef63d039ae7
https://github.com/WebKit/WebKit/commit/c2562ee994064554fd397a4b23345ef63d039ae7
Author: Chris Dumez <[email protected]>
Date: 2026-07-23 (Thu, 23 Jul 2026)
Changed paths:
M Source/WebKit/Shared/LogStream.mm
Log Message:
-----------
REGRESSION(317709@main):
http/tests/site-isolation/history/back-iframe-cross-site-no-bf-cache.html
crashes invalidating LogStream's IPC connection off the log work queue
https://bugs.webkit.org/show_bug.cgi?id=320138
rdar://183053307
Reviewed by Per Arne Vollan.
317709@main fixed a LogStream connection leak by having
LogStream::stopListeningForIPC() invalidate its StreamServerConnection's
underlying IPC::Connection. However, stopListeningForIPC() runs on the main
thread, while the LogStream's StreamServerConnection is opened on (and thus
bound to) the shared "Log work queue". IPC::Connection::invalidate() asserts
it is called on its own dispatcher (a release
ASSERT_WITH_SECURITY_IMPLICATION via assertIsCurrent(dispatcher())), so
invalidating from the main thread crashed on ASAN/debug builds during
WebProcessProxy::shutDown() -> stopLogStream().
Fix stopListeningForIPC() to dispatch the connection teardown
(stopReceivingMessages() + invalidate()) onto the log work queue so it runs
on the connection's own dispatcher. Unlike single-owner
StreamServerConnection users (e.g. RemoteRenderingBackend), we cannot call
StreamConnectionWorkQueue::stopAndWaitForCompletion() because the queue is
shared by every LogStream; we only invalidate our own connection.
The dispatched lambda captures a Ref to both the LogStream and its
connection. The connection Ref keeps the connection alive; the LogStream Ref
is required because StreamServerConnection::invalidate() clears its
CheckedPtr back to the client (m_client = nullptr), and the LogStream is
otherwise destroyed synchronously when ScopedActiveMessageReceiveQueue drops
its reference as soon as stopListeningForIPC() returns. LogStream is
ThreadSafeRefCounted with DestructionThread::Any, so destroying it (and its
WeakPtr<WebProcessProxy> member) off the main thread is safe.
Also hoist the log work queue from a static local in LogStream::create() to a
file-static logWorkQueue() accessor so stopListeningForIPC() can reach the
same queue.
* Source/WebKit/Shared/LogStream.mm:
(WebKit::logWorkQueue):
(WebKit::LogStream::stopListeningForIPC):
(WebKit::LogStream::create):
Canonical link: https://commits.webkit.org/317826@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
