File bug281495.patch of Package webkit2gtk3

Overview Repositories Revisions Requests Users Attributes Meta

File bug281495.patch of Package webkit2gtk3

From 8fd152326050b81559903682e0767d289adef9cb Mon Sep 17 00:00:00 2001
From: Michael Catanzaro <mcatanzaro@redhat.com>
Date: Wed, 16 Oct 2024 13:45:39 -0500
Subject: [PATCH] REGRESSION(283414@main): [WPE][GTK] Crash in ProcessLauncher
 socket monitor callback https://bugs.webkit.org/show_bug.cgi?id=281495

Reviewed by NOBODY (OOPS!).

The socket monitor callback that I added in 283414@main accidentally
deletes itself by calling m_socketMonitor.stop(). This causes the lambda
capture to itself be deleted. We can change the socket monitor to wait
until the callback has finished before deleting it.

* Source/WTF/wtf/glib/GSocketMonitor.cpp:
(WTF::GSocketMonitor::~GSocketMonitor):
(WTF::GSocketMonitor::socketSourceCallback):
(WTF::GSocketMonitor::stop):
---
 Source/WTF/wtf/glib/GSocketMonitor.cpp | 21 +++++++++++++++++++--
 Source/WTF/wtf/glib/GSocketMonitor.h   |  2 ++
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/Source/WTF/wtf/glib/GSocketMonitor.cpp b/Source/WTF/wtf/glib/GSocketMonitor.cpp
index c88ea9f91ca4..f3e31efb5053 100644
--- a/Source/WTF/wtf/glib/GSocketMonitor.cpp
+++ b/Source/WTF/wtf/glib/GSocketMonitor.cpp
@@ -33,6 +33,7 @@ namespace WTF {
 
 GSocketMonitor::~GSocketMonitor()
 {
+    RELEASE_ASSERT(!m_isExecutingCallback);
     stop();
 }
 
@@ -40,7 +41,17 @@ gboolean GSocketMonitor::socketSourceCallback(GSocket*, GIOCondition condition,
 {
     if (g_cancellable_is_cancelled(monitor->m_cancellable.get()))
         return G_SOURCE_REMOVE;
-    return monitor->m_callback(condition);
+
+    monitor->m_isExecutingCallback = true;
+    gboolean result = monitor->m_callback(condition);
+    monitor->m_isExecutingCallback = false;
+
+    if (monitor->m_shouldDestroyCallback) {
+        monitor->m_callback = nullptr;
+        monitor->m_shouldDestroyCallback = false;
+    }
+
+    return result;
 }
 
 void GSocketMonitor::start(GSocket* socket, GIOCondition condition, RunLoop& runLoop, Function<gboolean(GIOCondition)>&& callback)
@@ -65,7 +76,13 @@ void GSocketMonitor::stop()
     m_cancellable = nullptr;
     g_source_destroy(m_source.get());
     m_source = nullptr;
-    m_callback = nullptr;
+
+    // It's normal to stop the socket monitor from inside its callback.
+    // Don't destroy the callback while it's still executing.
+    if (m_isExecutingCallback)
+        m_shouldDestroyCallback = true;
+    else
+        m_callback = nullptr;
 }
 
 } // namespace WTF
diff --git a/Source/WTF/wtf/glib/GSocketMonitor.h b/Source/WTF/wtf/glib/GSocketMonitor.h
index 7ec383a6e37c..9393c546b593 100644
--- a/Source/WTF/wtf/glib/GSocketMonitor.h
+++ b/Source/WTF/wtf/glib/GSocketMonitor.h
@@ -51,6 +51,8 @@ private:
     GRefPtr<GSource> m_source;
     GRefPtr<GCancellable> m_cancellable;
     Function<gboolean(GIOCondition)> m_callback;
+    bool m_isExecutingCallback { false };
+    bool m_shouldDestroyCallback { false };
 };
 
 } // namespace WTF
-- 
2.46.1

Places

File bug281495.patch of Package webkit2gtk3

Places