Changeset 241594 in webkit

Timestamp:

Feb 15, 2019, 10:51:09 AM (6 years ago)

Author:

achristensen@apple.com

Message:

REGRESSION: ( r240978-r240985 ) [ iOS Release ] Layout Test imported/w3c/web-platform-tests/xhr/send-redirect-post-upload.htm is crashing
​https://bugs.webkit.org/show_bug.cgi?id=194523

Reviewed by Geoffrey Garen.

The scope of the FormCreationContext was limited to the scope of createHTTPBodyCFReadStream,
so when it was used in formCreate it was lucky to get the same context if the stack hadn't been overwritten
and if the FormData hadn't been freed. Instead, keep it alive with new/delete like we do the FormStreamFields.
A younger me should've noticed this when reviewing r218517.

• platform/network/cf/FormDataStreamCFNet.cpp:

(WebCore::formCreate):
(WebCore::createHTTPBodyCFReadStream):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/network/cf/FormDataStreamCFNet.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-02-15  Alex Christensen  <achristensen@webkit.org>
+
+        REGRESSION: ( r240978-r240985 ) [ iOS Release ] Layout Test imported/w3c/web-platform-tests/xhr/send-redirect-post-upload.htm is crashing
+        https://bugs.webkit.org/show_bug.cgi?id=194523
+
+        Reviewed by Geoffrey Garen.
+
+        The scope of the FormCreationContext was limited to the scope of createHTTPBodyCFReadStream,
+        so when it was used in formCreate it was lucky to get the same context if the stack hadn't been overwritten
+        and if the FormData hadn't been freed.  Instead, keep it alive with new/delete like we do the FormStreamFields.
+        A younger me should've noticed this when reviewing r218517.
+
+        * platform/network/cf/FormDataStreamCFNet.cpp:
+        (WebCore::formCreate):
+        (WebCore::createHTTPBodyCFReadStream):
+
 2019-02-15  Commit Queue  <commit-queue@webkit.org>
 

trunk/Source/WebCore/platform/network/cf/FormDataStreamCFNet.cpp

@@ -217 +217 @@
     newInfo->streamLength = formContext->streamLength;
     newInfo->bytesSent = 0;
+    
+    callOnMainThread([formContext] {
+        delete formContext;
+    });
 
     // Append in reverse order since we remove elements from the end.
@@ -381 +385 @@
         length += element.lengthInBytes();
 
-    FormCreationContext formContext = { WTFMove(resolvedFormData), length };
+    FormCreationContext* formContext = new FormCreationContext { WTFMove(resolvedFormData), length };
     CFReadStreamCallBacksV1 callBacks = { 1, formCreate, formFinalize, nullptr, formOpen, nullptr, formRead, nullptr, formCanRead, formClose, formCopyProperty, nullptr, nullptr, formSchedule, formUnschedule };
-    return adoptCF(CFReadStreamCreate(nullptr, static_cast<const void*>(&callBacks), &formContext));
+    return adoptCF(CFReadStreamCreate(nullptr, static_cast<const void*>(&callBacks), formContext));
 }