Web Inspector: CRASH when debugger closes while paused and remote inspecting a JSContext

https://bugs.webkit.org/show_bug.cgi?id=127757

Reviewed by Timothy Hatcher.

The problem was that the lifetime of the InspectorController and all agents
was tied to the remote inspector session. So, if a remote inspector was
disconnected while in the nested run loop, everything would get torn
down and when execution continued out of the nested runloop we would be
back in the original call stack of destroyed objects.

This patch changes the lifetime of the InspectorController and agents to
the JSGlobalObject. This way the agents are always alive, just the
frontend and backend channels are destroyed and recreated each remote
inspector session. This matches the agent lifetime for WebCore agents.
We can also later take advantage of the agents being alive before
and between inspector debug sessions to stash exception messages to
pass on to a debugger if a debugger is connected later.

* inspector/JSGlobalObjectInspectorController.h:
* inspector/JSGlobalObjectInspectorController.cpp:
(Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
Cleaner initialization of agents. Easier to follow.

(Inspector::JSGlobalObjectInspectorController::disconnectFrontend):
Move InjectedScript disconnection only once the global object is destroyed.
This way if a developer has attached once and included an injected script,
we will keep it around with any state it might want to remember until
the global object is destroyed.

(Inspector::JSGlobalObjectInspectorController::globalObjectDestroyed):
Disconnect agents and injected scripts when the global object is destroyed.

* inspector/InjectedScriptManager.cpp:
(Inspector::InjectedScriptManager::disconnect):
Now that the injected script manager is reused between remote
inspector sessions, don't clear the pointer on disconnect calls.
We now only call this once when the global object is getting
destroyed anyways so it doesn't matter. But if we wanted to call
disconnect multiple times, e.g. once per session, we could.

* inspector/ScriptDebugServer.cpp:
(Inspector::ScriptDebugServer::dispatchFunctionToListeners):
If the only listener was removed during the nested runloop, then when
we dispatch an event after the nested runloop the listener list will
be empty. Instead of asserting, just pass by an empty list.

* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::inspectorController):
Tie the inspector controller lifetime to the JSGlobalObject.

* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::~JSGlobalObject):
(JSC::JSGlobalObject::init):
Create the inspector controller, and eagerly signal teardown
in destruction.

* runtime/JSGlobalObjectDebuggable.h:
* runtime/JSGlobalObjectDebuggable.cpp:
(JSC::JSGlobalObjectDebuggable::connect):
(JSC::JSGlobalObjectDebuggable::disconnect):
(JSC::JSGlobalObjectDebuggable::dispatchMessageFromRemoteFrontend):
Simplify by using the inspector controller on JSGlobalObject.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@164151 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 126f482..8f168b7 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,69 @@
+2014-02-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: CRASH when debugger closes while paused and remote inspecting a JSContext
+        https://bugs.webkit.org/show_bug.cgi?id=127757
+
+        Reviewed by Timothy Hatcher.
+
+        The problem was that the lifetime of the InspectorController and all agents
+        was tied to the remote inspector session. So, if a remote inspector was
+        disconnected while in the nested run loop, everything would get torn
+        down and when execution continued out of the nested runloop we would be
+        back in the original call stack of destroyed objects.
+
+        This patch changes the lifetime of the InspectorController and agents to
+        the JSGlobalObject. This way the agents are always alive, just the
+        frontend and backend channels are destroyed and recreated each remote
+        inspector session. This matches the agent lifetime for WebCore agents.
+        We can also later take advantage of the agents being alive before
+        and between inspector debug sessions to stash exception messages to
+        pass on to a debugger if a debugger is connected later.
+
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        Cleaner initialization of agents. Easier to follow.
+
+        (Inspector::JSGlobalObjectInspectorController::disconnectFrontend):
+        Move InjectedScript disconnection only once the global object is destroyed.
+        This way if a developer has attached once and included an injected script,
+        we will keep it around with any state it might want to remember until
+        the global object is destroyed.
+
+        (Inspector::JSGlobalObjectInspectorController::globalObjectDestroyed):
+        Disconnect agents and injected scripts when the global object is destroyed.
+
+        * inspector/InjectedScriptManager.cpp:
+        (Inspector::InjectedScriptManager::disconnect):
+        Now that the injected script manager is reused between remote
+        inspector sessions, don't clear the pointer on disconnect calls.
+        We now only call this once when the global object is getting
+        destroyed anyways so it doesn't matter. But if we wanted to call
+        disconnect multiple times, e.g. once per session, we could.
+
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::dispatchFunctionToListeners):
+        If the only listener was removed during the nested runloop, then when
+        we dispatch an event after the nested runloop the listener list will
+        be empty. Instead of asserting, just pass by an empty list.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::inspectorController):
+        Tie the inspector controller lifetime to the JSGlobalObject.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::init):
+        Create the inspector controller, and eagerly signal teardown
+        in destruction.
+
+        * runtime/JSGlobalObjectDebuggable.h:
+        * runtime/JSGlobalObjectDebuggable.cpp:
+        (JSC::JSGlobalObjectDebuggable::connect):
+        (JSC::JSGlobalObjectDebuggable::disconnect):
+        (JSC::JSGlobalObjectDebuggable::dispatchMessageFromRemoteFrontend):
+        Simplify by using the inspector controller on JSGlobalObject.
+
 2014-02-14  Mark Hahnenberg  <mhahnenberg@apple.com>
 
         -[JSManagedValue value] needs to be protected by the API lock

diff --git a/Source/JavaScriptCore/inspector/InjectedScriptManager.cpp b/Source/JavaScriptCore/inspector/InjectedScriptManager.cpp
index 72d20df..b94be71 100644 (file)
--- a/Source/JavaScriptCore/inspector/InjectedScriptManager.cpp
+++ b/Source/JavaScriptCore/inspector/InjectedScriptManager.cpp
@@ -60,7 +60,6 @@ InjectedScriptManager::~InjectedScriptManager()
 void InjectedScriptManager::disconnect()
 {
     discardInjectedScripts();
-    m_injectedScriptHost = nullptr;
 }
 
 InjectedScriptHost* InjectedScriptManager::injectedScriptHost()

diff --git a/Source/JavaScriptCore/inspector/JSGlobalObjectInspectorController.cpp b/Source/JavaScriptCore/inspector/JSGlobalObjectInspectorController.cpp
index 75dbdb7..4dec996 100644 (file)
--- a/Source/JavaScriptCore/inspector/JSGlobalObjectInspectorController.cpp
+++ b/Source/JavaScriptCore/inspector/JSGlobalObjectInspectorController.cpp
@@ -48,21 +48,16 @@ JSGlobalObjectInspectorController::JSGlobalObjectInspectorController(JSGlobalObj
     , m_injectedScriptManager(std::make_unique<InjectedScriptManager>(*this, InjectedScriptHost::create()))
     , m_inspectorFrontendChannel(nullptr)
 {
-    m_agents.append(std::make_unique<InspectorAgent>());
-
-    auto runtimeAgentPtr = std::make_unique<JSGlobalObjectRuntimeAgent>(m_injectedScriptManager.get(), m_globalObject);
-    InspectorRuntimeAgent* runtimeAgent = runtimeAgentPtr.get();
-    m_agents.append(std::move(runtimeAgentPtr));
-
-    auto consoleAgentPtr = std::make_unique<JSGlobalObjectConsoleAgent>(m_injectedScriptManager.get());
-    InspectorConsoleAgent* consoleAgent = consoleAgentPtr.get();
-    m_agents.append(std::move(consoleAgentPtr));
-
-    auto debuggerAgentPtr = std::make_unique<JSGlobalObjectDebuggerAgent>(m_injectedScriptManager.get(), m_globalObject, consoleAgent);
-    InspectorDebuggerAgent* debuggerAgent = debuggerAgentPtr.get();
-    m_agents.append(std::move(debuggerAgentPtr));
+    auto runtimeAgent = std::make_unique<JSGlobalObjectRuntimeAgent>(m_injectedScriptManager.get(), m_globalObject);
+    auto consoleAgent = std::make_unique<JSGlobalObjectConsoleAgent>(m_injectedScriptManager.get());
+    auto debuggerAgent = std::make_unique<JSGlobalObjectDebuggerAgent>(m_injectedScriptManager.get(), m_globalObject, consoleAgent.get());
 
     runtimeAgent->setScriptDebugServer(&debuggerAgent->scriptDebugServer());
+
+    m_agents.append(std::make_unique<InspectorAgent>());
+    m_agents.append(std::move(runtimeAgent));
+    m_agents.append(std::move(consoleAgent));
+    m_agents.append(std::move(debuggerAgent));
 }
 
 JSGlobalObjectInspectorController::~JSGlobalObjectInspectorController()
@@ -70,6 +65,13 @@ JSGlobalObjectInspectorController::~JSGlobalObjectInspectorController()
     m_agents.discardAgents();
 }
 
+void JSGlobalObjectInspectorController::globalObjectDestroyed()
+{
+    disconnectFrontend(InspectorDisconnectReason::InspectedTargetDestroyed);
+
+    m_injectedScriptManager->disconnect();
+}
+
 void JSGlobalObjectInspectorController::connectFrontend(InspectorFrontendChannel* frontendChannel)
 {
     ASSERT(!m_inspectorFrontendChannel);
@@ -91,8 +93,6 @@ void JSGlobalObjectInspectorController::disconnectFrontend(InspectorDisconnectRe
     m_inspectorBackendDispatcher->clearFrontend();
     m_inspectorBackendDispatcher.clear();
     m_inspectorFrontendChannel = nullptr;
-
-    m_injectedScriptManager->disconnect();
 }
 
 void JSGlobalObjectInspectorController::dispatchMessageFromFrontend(const String& message)

diff --git a/Source/JavaScriptCore/inspector/JSGlobalObjectInspectorController.h b/Source/JavaScriptCore/inspector/JSGlobalObjectInspectorController.h
index 4b42b29..377f40e 100644 (file)
--- a/Source/JavaScriptCore/inspector/JSGlobalObjectInspectorController.h
+++ b/Source/JavaScriptCore/inspector/JSGlobalObjectInspectorController.h
@@ -56,6 +56,8 @@ public:
     void disconnectFrontend(InspectorDisconnectReason reason);
     void dispatchMessageFromFrontend(const String&);
 
+    void globalObjectDestroyed();
+
     virtual bool developerExtrasEnabled() const override { return true; }
     virtual bool canAccessInspectedScriptState(JSC::ExecState*) const override { return true; }
     virtual InspectorFunctionCallHandler functionCallHandler() const override;

diff --git a/Source/JavaScriptCore/inspector/ScriptDebugServer.cpp b/Source/JavaScriptCore/inspector/ScriptDebugServer.cpp
index e44609d..12dbaea 100644 (file)
--- a/Source/JavaScriptCore/inspector/ScriptDebugServer.cpp
+++ b/Source/JavaScriptCore/inspector/ScriptDebugServer.cpp
@@ -279,8 +279,8 @@ void ScriptDebugServer::dispatchFunctionToListeners(JavaScriptExecutionCallback
     TemporaryChange<bool> change(m_callingListeners, true);
 
     if (ListenerSet* listeners = getListenersForGlobalObject(globalObject)) {
-        ASSERT(!listeners->isEmpty());
-        dispatchFunctionToListeners(*listeners, callback);
+        if (!listeners->isEmpty())
+            dispatchFunctionToListeners(*listeners, callback);
     }
 }
 

diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
index 6ac477c..3dfaa2f 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -7,13 +7,13 @@
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer. 
+ *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution. 
+ *     documentation and/or other materials provided with the distribution.
  * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission. 
+ *     from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -60,6 +60,7 @@
 #include "JSArrayBufferPrototype.h"
 #include "JSArrayIterator.h"
 #include "JSBoundFunction.h"
+#include "JSCInlines.h"
 #include "JSCallbackConstructor.h"
 #include "JSCallbackFunction.h"
 #include "JSCallbackObject.h"
@@ -100,7 +101,6 @@
 #include "ObjCCallbackFunction.h"
 #include "ObjectConstructor.h"
 #include "ObjectPrototype.h"
-#include "JSCInlines.h"
 #include "ParserError.h"
 #include "RegExpConstructor.h"
 #include "RegExpMatchesArray.h"
@@ -124,7 +124,7 @@
 
 #if ENABLE(REMOTE_INSPECTOR)
 #include "JSGlobalObjectDebuggable.h"
-#include "RemoteInspector.h"
+#include "JSGlobalObjectInspectorController.h"
 #endif
 
 #if ENABLE(WEB_REPLAY)
@@ -171,6 +171,10 @@ JSGlobalObject::JSGlobalObject(VM& vm, Structure* structure, const GlobalObjectM
 
 JSGlobalObject::~JSGlobalObject()
 {
+#if ENABLE(REMOTE_INSPECTOR)
+    m_inspectorController->globalObjectDestroyed();
+#endif
+
     if (m_debugger)
         m_debugger->detach(this, Debugger::GlobalObjectIsDestructing);
 
@@ -184,7 +188,7 @@ void JSGlobalObject::destroy(JSCell* cell)
 }
 
 void JSGlobalObject::setGlobalThis(VM& vm, JSObject* globalThis)
-{ 
+{
     m_globalThis.set(vm, this, globalThis);
 }
 
@@ -198,6 +202,7 @@ void JSGlobalObject::init(JSObject* thisValue)
     m_debugger = 0;
 
 #if ENABLE(REMOTE_INSPECTOR)
+    m_inspectorController = std::make_unique<Inspector::JSGlobalObjectInspectorController>(*this);
     m_inspectorDebuggable = std::make_unique<JSGlobalObjectDebuggable>(*this);
     m_inspectorDebuggable->init();
     m_inspectorDebuggable->setRemoteDebuggingAllowed(true);

diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.h b/Source/JavaScriptCore/runtime/JSGlobalObject.h
index 6e94929..80ea70c 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.h
@@ -46,6 +46,10 @@
 struct OpaqueJSClass;
 struct OpaqueJSClassContextData;
 
+namespace Inspector {
+class JSGlobalObjectInspectorController;
+}
+
 namespace JSC {
 
 class ArrayPrototype;
@@ -233,6 +237,7 @@ protected:
 #endif
 
 #if ENABLE(REMOTE_INSPECTOR)
+    std::unique_ptr<Inspector::JSGlobalObjectInspectorController> m_inspectorController;
     std::unique_ptr<JSGlobalObjectDebuggable> m_inspectorDebuggable;
 #endif
 
@@ -430,6 +435,10 @@ public:
     InputCursor& inputCursor() const { return *m_inputCursor; }
 #endif
 
+#if ENABLE(REMOTE_INSPECTOR)
+    Inspector::JSGlobalObjectInspectorController& inspectorController() const { return *m_inspectorController.get(); }
+#endif
+
     void setName(const String&);
     const String& name() const { return m_name; }
 

diff --git a/Source/JavaScriptCore/runtime/JSGlobalObjectDebuggable.cpp b/Source/JavaScriptCore/runtime/JSGlobalObjectDebuggable.cpp
index 2b89507..c789963 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSGlobalObjectDebuggable.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObjectDebuggable.cpp
@@ -43,12 +43,6 @@ JSGlobalObjectDebuggable::JSGlobalObjectDebuggable(JSGlobalObject& globalObject)
 {
 }
 
-JSGlobalObjectDebuggable::~JSGlobalObjectDebuggable()
-{
-    if (m_inspectorController)
-        disconnectInternal(InspectorDisconnectReason::InspectedTargetDestroyed);
-}
-
 String JSGlobalObjectDebuggable::name() const
 {
     String name = m_globalObject.name();
@@ -59,29 +53,21 @@ void JSGlobalObjectDebuggable::connect(InspectorFrontendChannel* frontendChannel
 {
     APIEntryShim entryShim(&m_globalObject.vm());
 
-    ASSERT(!m_inspectorController);
-    m_inspectorController = std::make_unique<Inspector::JSGlobalObjectInspectorController>(m_globalObject);
-    m_inspectorController->connectFrontend(frontendChannel);
+    m_globalObject.inspectorController().connectFrontend(frontendChannel);
 }
 
 void JSGlobalObjectDebuggable::disconnect()
 {
-    disconnectInternal(InspectorDisconnectReason::InspectorDestroyed);
-}
-
-void JSGlobalObjectDebuggable::disconnectInternal(InspectorDisconnectReason reason)
-{
     APIEntryShim entryShim(&m_globalObject.vm());
 
-    m_inspectorController->disconnectFrontend(reason);
-    m_inspectorController = nullptr;
+    m_globalObject.inspectorController().disconnectFrontend(InspectorDisconnectReason::InspectorDestroyed);
 }
 
 void JSGlobalObjectDebuggable::dispatchMessageFromRemoteFrontend(const String& message)
 {
     APIEntryShim entryShim(&m_globalObject.vm());
 
-    m_inspectorController->dispatchMessageFromFrontend(message);
+    m_globalObject.inspectorController().dispatchMessageFromFrontend(message);
 }
 
 } // namespace JSC

diff --git a/Source/JavaScriptCore/runtime/JSGlobalObjectDebuggable.h b/Source/JavaScriptCore/runtime/JSGlobalObjectDebuggable.h
index cf3ef1e..9f4b6e8 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSGlobalObjectDebuggable.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObjectDebuggable.h
@@ -44,7 +44,7 @@ class JSGlobalObjectDebuggable final : public Inspector::RemoteInspectorDebuggab
     WTF_MAKE_NONCOPYABLE(JSGlobalObjectDebuggable);
 public:
     JSGlobalObjectDebuggable(JSGlobalObject&);
-    ~JSGlobalObjectDebuggable();
+    ~JSGlobalObjectDebuggable() { }
 
     virtual Inspector::RemoteInspectorDebuggable::DebuggableType type() const override { return Inspector::RemoteInspectorDebuggable::JavaScript; }
 
@@ -56,10 +56,7 @@ public:
     virtual void dispatchMessageFromRemoteFrontend(const String& message) override;
 
 private:
-    void disconnectInternal(Inspector::InspectorDisconnectReason reason);
-
     JSGlobalObject& m_globalObject;
-    std::unique_ptr<Inspector::JSGlobalObjectInspectorController> m_inspectorController;
 };
 
 } // namespace JSC