Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-17 06:09:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1907726 - Make sure WebTransportSessionProxy::NotifyDatagramReceived is called after OnStopRequest, r=necko-reviewers,jesup

Browse Source 
The crash occurs because WebTransportSessionProxy::OnDatagramReceivedInternal is called before WebTransportSessionProxy::OnStopRequest.
When this happens, WebTransportSessionProxy::mTarget is the main thread, so a task is dispatched to the main thread. This causes WebTransportSessionProxy::NotifyDatagramReceived to be called on the main thread.

If WebTransportSessionProxy::NotifyDatagramReceived is invoked while WebTransportSessionProxy::mStopRequestCalled is true, it can lead to OnDatagramReceived being called on the main thread (instead of the socket thread), resulting in a crash.

Differential Revision: https://phabricator.services.mozilla.com/D220013
This commit is contained in:
Kershaw Chang 2024-08-23 20:40:13 +00:00
parent 042cf5fb44
commit f994878fcd
1 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
netwerk/protocol/webtransport/WebTransportSessionProxy.cpp
View File

@ -1078,15 +1078,6 @@ void WebTransportSessionProxy::NotifyDatagramReceived(
MutexAutoLock lock(mMutex); MutexAutoLock lock(mMutex);
MOZ_ASSERT(mTarget->IsOnCurrentThread()); MOZ_ASSERT(mTarget->IsOnCurrentThread());
if (!mStopRequestCalled) {
CopyableTArray<uint8_t> copied(aData);
mPendingEvents.AppendElement(
[self = RefPtr{this}, data = std::move(copied)]() mutable {
self->NotifyDatagramReceived(std::move(data));
});
return;
}
if (mState != WebTransportSessionProxyState::ACTIVE || !mListener) { if (mState != WebTransportSessionProxyState::ACTIVE || !mListener) {
return; return;
} }
@ -1102,6 +1093,15 @@ NS_IMETHODIMP WebTransportSessionProxy::OnDatagramReceivedInternal(
{ {
MutexAutoLock lock(mMutex); MutexAutoLock lock(mMutex);
if (!mStopRequestCalled) {
CopyableTArray<uint8_t> copied(aData);
mPendingEvents.AppendElement(
[self = RefPtr{this}, data = std::move(copied)]() mutable {
self->OnDatagramReceivedInternal(std::move(data));
});
return NS_OK;
}
if (!mTarget->IsOnCurrentThread()) { if (!mTarget->IsOnCurrentThread()) {
return mTarget->Dispatch(NS_NewRunnableFunction( return mTarget->Dispatch(NS_NewRunnableFunction(
"WebTransportSessionProxy::OnDatagramReceived", "WebTransportSessionProxy::OnDatagramReceived",