DOMMatrixReadOnly::setMatrixValueFromString unsafely uses ComputedStyle and related machinery from a background thread |
|||||||||
Issue descriptionComputedStyle and all the related machinery can only be used from the main thread. DOMMatrix and all of the geometry types have Exposed=(Window, Worker) which is not safe. We unfortunately don't have good asserts for this, but this is racing on the ref count of every shared structure inside ComputedStyle, likely to cause leaks or crashes.
,
Apr 14 2017
Removing Blink>DOM because DOMMatrixReadOnly is not in the scope of Blink>DOM. We should have something like Blink>Geometry.
,
Apr 25 2017
,
Apr 25 2017
The geometry types are not a part of the bindings. What team owns DOMClientRect? What team did the code reviews for the new geometry types code? I think this feature needs an owner before shipping and that all the geometry types should belong to one of DOM, CSS, Paint or Layout teams. Adding a more specific bug component like Blink>Geometry doesn't address the team ownership problem.
,
Apr 25 2017
I think it should be the CSS team that owns at least DOMRect, because the main API using it is getBoundingClientRect() defined in https://drafts.csswg.org/cssom-view/#extension-to-the-element-interface It makes sense for DOMMatrix too, given the entanglement with the parser. Just my 2c.
,
Apr 27 2017
,
Apr 28 2017
Not a P1 because we do not need it for a current milestone, and as I understand it we have not shipped the geometry types yet. Correct me (and adjust the priority) if I'm wrong. When a decision is made to ship the priority needs to be bumped, a release version needs to be attached, and probably also needs a ReleaseBlock if it really is such a serious concern.
,
May 8 2017
Okey. So 3 things about this. 1. According to https://drafts.fxtf.org/geometry/#dom-dommatrixreadonly-dommatrixreadonly, we should never call SetMatrixValueFromString on the worker. I'm preparing a CL to fix this today. This bug will be a non-issue. 2. Seeing this code reminded me that FilterOperationResolver does have a use case for resolving Canvas2D filters on Workers that have a similar code: https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/css/resolver/FilterOperationResolver.cpp?type=cs&q=CreateOffscreenFilterOperations&sq=package:chromium&l=208 (ignore the viewport_size part, we are still debating what's the proper viewport spec-wise). This code has the exact same problem pointed out by this bug. 3. As Elliott pointed out, this should be currently safe unless CSSToLengthConversionData ever decides to start changing something global. At this point, I'd say that we probably need to fork CSSToLengthConversionData (and CHECK the proper threads) and keep a thread-safe version of it. Design-wise, I don't know how to make this explicit, except for having what we currently do: have tests on separate threads and hope that when the function becomes unsafe there will be a new CHECK that will fail. Ideas?
,
May 8 2017
,
May 8 2017
,
May 12 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/d72fe5c3a271ab3e63f2ca5c247b3e4e686e275b commit d72fe5c3a271ab3e63f2ca5c247b3e4e686e275b Author: fserb <fserb@chromium.org> Date: Fri May 12 02:04:03 2017 Stop accepting string constructor of DOMMatrix on workers This conforms to the spec: https://drafts.fxtf.org/geometry/#dom-dommatrixreadonly-dommatrixreadonly And ensures that we don't call SetMatrixValueFromString inside a worker BUG= 703908 Review-Url: https://codereview.chromium.org/2868953002 Cr-Commit-Position: refs/heads/master@{#471182} [modify] https://crrev.com/d72fe5c3a271ab3e63f2ca5c247b3e4e686e275b/third_party/WebKit/Source/core/geometry/DOMMatrix.cpp [modify] https://crrev.com/d72fe5c3a271ab3e63f2ca5c247b3e4e686e275b/third_party/WebKit/Source/core/geometry/DOMMatrix.h [modify] https://crrev.com/d72fe5c3a271ab3e63f2ca5c247b3e4e686e275b/third_party/WebKit/Source/core/geometry/DOMMatrix.idl [modify] https://crrev.com/d72fe5c3a271ab3e63f2ca5c247b3e4e686e275b/third_party/WebKit/Source/core/geometry/DOMMatrixReadOnly.cpp [modify] https://crrev.com/d72fe5c3a271ab3e63f2ca5c247b3e4e686e275b/third_party/WebKit/Source/core/geometry/DOMMatrixReadOnly.h [modify] https://crrev.com/d72fe5c3a271ab3e63f2ca5c247b3e4e686e275b/third_party/WebKit/Source/core/geometry/DOMMatrixReadOnly.idl
,
May 12 2017
The geometry specific issue is closed. I've created http://crbug.com/721768 to follow up on this outside Geometry. |
|||||||||
►
Sign in to add a comment |
|||||||||
Comment 1 by esprehn@chromium.org
, Mar 22 2017