Changeset 244030 in webkit

Timestamp:

Apr 8, 2019, 11:45:15 AM (7 years ago)

Author:

achristensen@apple.com

Message:

REGRESSION(236463) DownloadManager can call a null CompletionHandler
​https://bugs.webkit.org/show_bug.cgi?id=196414
<rdar://problem/48389434>

Reviewed by Geoff Garen.

• NetworkProcess/NetworkResourceLoader.cpp:

(WebKit::NetworkResourceLoader::convertToDownload):
DownloadManager::continueDecidePendingDownloadDestination is being called when there is no completion handler.
r236463 introduced an unchecked code path that can allow this to happen.

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• NetworkProcess/NetworkResourceLoader.cpp (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-04-08  Alex Christensen  <achristensen@webkit.org>
+
+        REGRESSION(236463) DownloadManager can call a null CompletionHandler
+        https://bugs.webkit.org/show_bug.cgi?id=196414
+        <rdar://problem/48389434>
+
+        Reviewed by Geoff Garen.
+
+        * NetworkProcess/NetworkResourceLoader.cpp:
+        (WebKit::NetworkResourceLoader::convertToDownload):
+        DownloadManager::continueDecidePendingDownloadDestination is being called when there is no completion handler.
+        r236463 introduced an unchecked code path that can allow this to happen.
+
 2019-04-07  Commit Queue  <commit-queue@webkit.org>
 

trunk/Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp

@@ -322 +322 @@
     }
 
-    ASSERT(m_responseCompletionHandler);
-    m_connection->networkProcess().downloadManager().convertNetworkLoadToDownload(downloadID, std::exchange(m_networkLoad, nullptr), WTFMove(m_responseCompletionHandler), WTFMove(m_fileReferences), request, response);
+    if (m_responseCompletionHandler)
+        m_connection->networkProcess().downloadManager().convertNetworkLoadToDownload(downloadID, std::exchange(m_networkLoad, nullptr), WTFMove(m_responseCompletionHandler), WTFMove(m_fileReferences), request, response);
 }