Changeset 212330 in webkit

Timestamp:

Feb 14, 2017 3:26:38 PM (7 years ago)

Author:

beidson@apple.com

Message:

Speculative fix for: Crash in DocumentThreadableLoader::redirectReceived.
<rdar://problem/29899473> and ​https://bugs.webkit.org/show_bug.cgi?id=168337

Reviewed by Geoffrey Garen.

No new tests (Unable to find a reproduction).

• loader/DocumentThreadableLoader.cpp:

(WebCore::DocumentThreadableLoader::loadRequest):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• loader/DocumentThreadableLoader.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2017-02-14  Brady Eidson  <beidson@apple.com>
+
+        Speculative fix for: Crash in DocumentThreadableLoader::redirectReceived.
+        <rdar://problem/29899473> and https://bugs.webkit.org/show_bug.cgi?id=168337
+
+        Reviewed by Geoffrey Garen.
+
+        No new tests (Unable to find a reproduction).
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::loadRequest):
+
 2017-02-14  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebCore/loader/DocumentThreadableLoader.cpp

@@ -367 +367 @@
 void DocumentThreadableLoader::loadRequest(ResourceRequest&& request, SecurityCheckPolicy securityCheck)
 {
+    Ref<DocumentThreadableLoader> protectedThis(*this);
+
     // Any credential should have been removed from the cross-site requests.
     const URL& requestURL = request.url();
@@ -388 +390 @@
 
         ASSERT(!m_resource);
+        if (m_resource) {
+            CachedResourceHandle<CachedRawResource> resource = std::exchange(m_resource, nullptr);
+            resource->removeClient(*this);
+        }
+
         // We create an URL here as the request will be moved in requestRawResource
         URL requestUrl = newRequest.resourceRequest().url();