Changeset 187466 in webkit

Timestamp:

Jul 27, 2015 5:06:32 PM (9 years ago)

Author:

beidson@apple.com

Message:

Crash in WebCore::DocumentLoader::willSendRequest() with ContentFilter and AppCache.
<rdar://problem/21960398> and ​https://bugs.webkit.org/show_bug.cgi?id=147339

Reviewed by Alexey Proskuryakov.

No new tests (Not yet proven to be possible to test this).

• loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::willSendRequest): Grab the identifier from the CachedResource directly, not from the null ResourceLoader.
(WebCore::DocumentLoader::continueAfterNavigationPolicy): Null check the ResourceLoader, as it can definitely be gone by this point.

• loader/cache/CachedResource.cpp:

(WebCore::CachedResource::clearLoader): Save off the identifier for later use.

• loader/cache/CachedResource.h:

(WebCore::CachedResource::identifierForLoadWithoutResourceLoader): Expose the identifier that the ResourceLoader had when it went away.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• loader/DocumentLoader.cpp (modified) (2 diffs)
• loader/cache/CachedResource.cpp (modified) (1 diff)
• loader/cache/CachedResource.h (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2015-07-27  Brady Eidson  <beidson@apple.com>
+
+        Crash in WebCore::DocumentLoader::willSendRequest() with ContentFilter and AppCache.
+        <rdar://problem/21960398> and https://bugs.webkit.org/show_bug.cgi?id=147339
+
+        Reviewed by Alexey Proskuryakov.
+
+        No new tests (Not yet proven to be possible to test this).
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::willSendRequest): Grab the identifier from the CachedResource directly, not from the null ResourceLoader.
+        (WebCore::DocumentLoader::continueAfterNavigationPolicy): Null check the ResourceLoader, as it can definitely be gone by this point.
+
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::clearLoader): Save off the identifier for later use.
+        * loader/cache/CachedResource.h:
+        (WebCore::CachedResource::identifierForLoadWithoutResourceLoader): Expose the identifier that the ResourceLoader had when it went away.
+
 2015-07-27  Said Abou-Hallawa  <sabouhallawa@apple.com>
 

trunk/Source/WebCore/loader/DocumentLoader.cpp

@@ -551 +551 @@
         ASSERT(!m_substituteData.isValid());
         m_applicationCacheHost->maybeLoadMainResourceForRedirect(newRequest, m_substituteData);
-        if (m_substituteData.isValid())
-            m_identifierForLoadWithoutResourceLoader = mainResourceLoader()->identifier();
+        if (m_substituteData.isValid()) {
+            RELEASE_ASSERT(m_mainResource);
+            m_identifierForLoadWithoutResourceLoader = m_mainResource->identifierForLoadWithoutResourceLoader();
+        }
     }
 
@@ -582 +584 @@
         // but prevent the ResourceLoader from sending ResourceLoadNotifier callbacks.
         RefPtr<ResourceLoader> resourceLoader = mainResourceLoader();
-        ASSERT(resourceLoader->shouldSendResourceLoadCallbacks());
-        resourceLoader->setSendCallbackPolicy(DoNotSendCallbacks);
+        if (resourceLoader) {
+            ASSERT(resourceLoader->shouldSendResourceLoadCallbacks());
+            resourceLoader->setSendCallbackPolicy(DoNotSendCallbacks);
+        }
+
         clearMainResource();
-        resourceLoader->setSendCallbackPolicy(SendCallbacks);
+
+        if (resourceLoader)
+            resourceLoader->setSendCallbackPolicy(SendCallbacks);
         handleSubstituteDataLoadSoon();
     }

trunk/Source/WebCore/loader/cache/CachedResource.cpp

@@ -406 +406 @@
 {
     ASSERT(m_loader);
+    m_identifierForLoadWithoutResourceLoader = m_loader->identifier();
     m_loader = nullptr;
     deleteIfPossible();

trunk/Source/WebCore/loader/cache/CachedResource.h

@@ -261 +261 @@
 #endif
 
+    unsigned long identifierForLoadWithoutResourceLoader() const { return m_identifierForLoadWithoutResourceLoader; }
+
 protected:
     void setEncodedSize(unsigned);
@@ -342 +344 @@
 
     RedirectChainCacheStatus m_redirectChainCacheStatus;
+
+    unsigned long m_identifierForLoadWithoutResourceLoader { 0 };
 };