Changeset 247787 in webkit

Timestamp:

Jul 24, 2019 1:28:31 PM (5 years ago)

Author:

beidson@apple.com

Message:

Crash in WebContent process with custom schemes.
<rdar://problem/52968793> and ​https://bugs.webkit.org/show_bug.cgi?id=200062

Reviewed by Andy Estes.

Almost everywhere in WebURLSchemeTaskProxy where we call processNextPendingTask() we first protect the task with a ref.
But not in didReceiveData.
So lets do that.

• WebProcess/WebPage/WebURLSchemeTaskProxy.cpp:

(WebKit::WebURLSchemeTaskProxy::didReceiveData): Protect this.

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/WebPage/WebURLSchemeTaskProxy.cpp (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-07-24  Brady Eidson  <beidson@apple.com>
+
+        Crash in WebContent process with custom schemes.
+        <rdar://problem/52968793> and https://bugs.webkit.org/show_bug.cgi?id=200062
+
+        Reviewed by Andy Estes.
+
+        Almost everywhere in WebURLSchemeTaskProxy where we call processNextPendingTask() we first protect the task with a ref.
+        But not in didReceiveData.
+        So lets do that.
+
+        * WebProcess/WebPage/WebURLSchemeTaskProxy.cpp:
+        (WebKit::WebURLSchemeTaskProxy::didReceiveData): Protect this.
+
 2019-07-24  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebKit/WebProcess/WebPage/WebURLSchemeTaskProxy.cpp

@@ -126 +126 @@
     }
 
+    auto protectedThis = makeRef(*this);
     m_coreLoader->didReceiveData(reinterpret_cast<const char*>(data), size, 0, DataPayloadType::DataPayloadBytes);
     processNextPendingTask();