New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 703908 link

Starred by 3 users

Issue metadata

Status: Fixed
Owner:
Closed: May 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug

Blocking:
issue 388780
issue 581955



Sign in to add a comment

DOMMatrixReadOnly::setMatrixValueFromString unsafely uses ComputedStyle and related machinery from a background thread

Project Member Reported by esprehn@chromium.org, Mar 22 2017

Issue description

ComputedStyle and all the related machinery can only be used from the main thread. DOMMatrix and all of the geometry types have Exposed=(Window, Worker) which is not safe.

We unfortunately don't have good asserts for this, but this is racing on the ref count of every shared structure inside ComputedStyle, likely to cause leaks or crashes.
 
I think the current code is currently okay because:
- initialStyle() returns a const reference
- CSSToLengthConversionData takes a raw ptr to a ComputedStyle and doesn't store it in a RefPtr.

But from a system design perspective these classes can only be used from main, for example we might lazy allocate the nested fields inside it, or something inside CSSToLengthConversionData could call a function that refs the style.

Comment 2 by tkent@chromium.org, Apr 14 2017

Components: -Blink>DOM
Removing Blink>DOM because DOMMatrixReadOnly is not in the scope of Blink>DOM.  We should have something like Blink>Geometry.


Components: Blink>Bindings
Cc: dglazkov@chromium.org
Components: -Blink>Bindings Blink
The geometry types are not a part of the bindings. What team owns DOMClientRect? What team did the code reviews for the new geometry types code?

I think this feature needs an owner before shipping and that all the geometry types should belong to one of DOM, CSS, Paint or Layout teams. Adding a more specific bug component like Blink>Geometry doesn't address the team ownership problem. 

Comment 5 by foolip@chromium.org, Apr 25 2017

I think it should be the CSS team that owns at least DOMRect, because the main API using it is getBoundingClientRect() defined in https://drafts.csswg.org/cssom-view/#extension-to-the-element-interface

It makes sense for DOMMatrix too, given the entanglement with the parser.

Just my 2c.
Components: -Blink Blink>Paint
Owner: chrishtr@chromium.org
Status: Assigned (was: Untriaged)
Labels: -Pri-1 BugSource-Chromium PaintTeamTriaged-20170428 Pri-2
Not a P1 because we do not need it for a current milestone, and as I understand it we have not shipped the geometry types yet. Correct me (and adjust the priority) if I'm wrong.

When a decision is made to ship the priority needs to be bumped, a release version needs to be attached, and probably also needs a ReleaseBlock if it really is such a serious concern.

Comment 8 by fs...@chromium.org, May 8 2017

Okey.
So 3 things about this.

1. According to https://drafts.fxtf.org/geometry/#dom-dommatrixreadonly-dommatrixreadonly, we should never call SetMatrixValueFromString on the worker. I'm preparing a CL to fix this today. This bug will be a non-issue.

2. Seeing this code reminded me that FilterOperationResolver does have a use case for resolving Canvas2D filters on Workers that have a similar code: https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/css/resolver/FilterOperationResolver.cpp?type=cs&q=CreateOffscreenFilterOperations&sq=package:chromium&l=208

(ignore the viewport_size part, we are still debating what's the proper viewport spec-wise). This code has the exact same problem pointed out by this bug.

3. As Elliott pointed out, this should be currently safe unless CSSToLengthConversionData ever decides to start changing something global. At this point, I'd say that we probably need to fork CSSToLengthConversionData (and CHECK the proper threads) and keep a thread-safe version of it. Design-wise, I don't know how to make this explicit, except for having what we currently do: have tests on separate threads and hope that when the function becomes unsafe there will be a new CHECK that will fail.

Ideas?

Comment 9 by fs...@chromium.org, May 8 2017

Cc: junov@chromium.org
Cc: chrishtr@chromium.org
Owner: fs...@chromium.org
Status: Started (was: Assigned)

Comment 12 by fs...@chromium.org, May 12 2017

Status: Fixed (was: Started)
The geometry specific issue is closed.
I've created  http://crbug.com/721768  to follow up on this outside Geometry. 

Sign in to add a comment