Skip to content
Snippets Groups Projects
Verified Commit 63f27157 authored by Kershaw Chang's avatar Kershaw Chang Committed by ma1
Browse files

Bug 1907726 - Make sure WebTransportSessionProxy::NotifyDatagramReceived is...

Bug 1907726 - Make sure WebTransportSessionProxy::NotifyDatagramReceived is called after OnStopRequest,  a=RyanVM

The crash occurs because WebTransportSessionProxy::OnDatagramReceivedInternal is called before WebTransportSessionProxy::OnStopRequest.
When this happens, WebTransportSessionProxy::mTarget is the main thread, so a task is dispatched to the main thread. This causes WebTransportSessionProxy::NotifyDatagramReceived to be called on the main thread.

If WebTransportSessionProxy::NotifyDatagramReceived is invoked while WebTransportSessionProxy::mStopRequestCalled is true, it can lead to OnDatagramReceived being called on the main thread (instead of the socket thread), resulting in a crash.

Original Revision: https://phabricator.services.mozilla.com/D220013

Differential Revision: https://phabricator.services.mozilla.com/D221661
parent e31a1dc7
No related branches found
No related tags found
1 merge request!1326Bug 43383: Rebased legacy onto 115.19.0esr
......@@ -1042,15 +1042,6 @@ void WebTransportSessionProxy::NotifyDatagramReceived(
MutexAutoLock lock(mMutex);
MOZ_ASSERT(mTarget->IsOnCurrentThread());
if (!mStopRequestCalled) {
CopyableTArray<uint8_t> copied(aData);
mPendingEvents.AppendElement(
[self = RefPtr{this}, data = std::move(copied)]() mutable {
self->NotifyDatagramReceived(std::move(data));
});
return;
}
if (mState != WebTransportSessionProxyState::ACTIVE || !mListener) {
return;
}
......@@ -1066,6 +1057,15 @@ NS_IMETHODIMP WebTransportSessionProxy::OnDatagramReceivedInternal(
{
MutexAutoLock lock(mMutex);
if (!mStopRequestCalled) {
CopyableTArray<uint8_t> copied(aData);
mPendingEvents.AppendElement(
[self = RefPtr{this}, data = std::move(copied)]() mutable {
self->OnDatagramReceivedInternal(std::move(data));
});
return NS_OK;
}
if (!mTarget->IsOnCurrentThread()) {
return mTarget->Dispatch(NS_NewRunnableFunction(
"WebTransportSessionProxy::OnDatagramReceived",
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment