Changeset 268910 in webkit

Timestamp:

Oct 23, 2020, 1:25:31 AM (6 years ago)

Author:

Carlos Garcia Campos

Message:

Merge r268906 - [SOUP] Fix crash in WebSocketTask
​https://bugs.webkit.org/show_bug.cgi?id=217892

Patch by Michael Catanzaro <Michael Catanzaro> on 2020-10-23
Reviewed by Carlos Garcia Campos.

The WebSocketTask connects to the "starting" signal of its SoupMessage and never disconnects
this signal, which is only safe if it is guaranteed to outlive its SoupMessage. However, it
is not. We crash when the signal is emitted after the WebSocketTask is destroyed. To solve
this, we just need to disconnect the signal when required. Normally that would be done in
the destructor, but the WebSocketTask drops its ownership of the SoupMessage prior to that
point, so we need to disconnect on each possible paths.

• NetworkProcess/soup/WebSocketTaskSoup.cpp:

(WebKit::WebSocketTask::~WebSocketTask):
(WebKit::WebSocketTask::didConnect):
(WebKit::WebSocketTask::didFail):

Location:

releases/WebKitGTK/webkit-2.30/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• NetworkProcess/soup/WebSocketTaskSoup.cpp (modified) (3 diffs)

releases/WebKitGTK/webkit-2.30/Source/WebKit/ChangeLog

@@ +1 @@
+2020-10-23  Michael Catanzaro  <mcatanzaro@gnome.org>
+
+        [SOUP] Fix crash in WebSocketTask
+        https://bugs.webkit.org/show_bug.cgi?id=217892
+
+        Reviewed by Carlos Garcia Campos.
+
+        The WebSocketTask connects to the "starting" signal of its SoupMessage and never disconnects
+        this signal, which is only safe if it is guaranteed to outlive its SoupMessage. However, it
+        is not. We crash when the signal is emitted after the WebSocketTask is destroyed. To solve
+        this, we just need to disconnect the signal when required. Normally that would be done in
+        the destructor, but the WebSocketTask drops its ownership of the SoupMessage prior to that
+        point, so we need to disconnect on each possible paths.
+
+        * NetworkProcess/soup/WebSocketTaskSoup.cpp:
+        (WebKit::WebSocketTask::~WebSocketTask):
+        (WebKit::WebSocketTask::didConnect):
+        (WebKit::WebSocketTask::didFail):
+
 2020-10-10  Adrian Perez de Castro  <aperez@igalia.com>
 

releases/WebKitGTK/webkit-2.30/Source/WebKit/NetworkProcess/soup/WebSocketTaskSoup.cpp

@@ -90 +90 @@
 WebSocketTask::~WebSocketTask()
 {
+    if (m_handshakeMessage)
+        g_signal_handlers_disconnect_by_data(m_handshakeMessage.get(), this);
+
     cancel();
 }
@@ -134 +137 @@
     response.updateFromSoupMessage(m_handshakeMessage.get());
     m_channel.didReceiveHandshakeResponse(WTFMove(response));
+    g_signal_handlers_disconnect_by_data(m_handshakeMessage.get(), this);
     m_handshakeMessage = nullptr;
 }
@@ -173 +177 @@
         response.updateFromSoupMessage(m_handshakeMessage.get());
         m_channel.didReceiveHandshakeResponse(WTFMove(response));
+        g_signal_handlers_disconnect_by_data(m_handshakeMessage.get(), this);
         m_handshakeMessage = nullptr;
     }