Changeset 294692 in webkit

Timestamp:

May 23, 2022, 4:25:36 PM (3 years ago)

Author:

Chris Dumez

Message:

Capture WeakPtr to CachedResourceClient in lambdas in CachedRawResource::didAddClient()
​https://bugs.webkit.org/show_bug.cgi?id=240828
<rdar://93781799>

Reviewed by Alex Christensen.

Capture WeakPtr to CachedResourceClient in lambdas in CachedRawResource::didAddClient()
instead of a raw pointer, for hardening.

• Source/WebCore/loader/cache/CachedRawResource.cpp:

(WebCore::iterateRedirects):
(WebCore::CachedRawResource::didAddClient):

Canonical link: ​https://commits.webkit.org/250896@main

File:

• trunk/Source/WebCore/loader/cache/CachedRawResource.cpp (modified) (2 diffs)

trunk/Source/WebCore/loader/cache/CachedRawResource.cpp

@@ -151 +151 @@
         return completionHandler({ });
     auto redirectPair = redirectsInReverseOrder.takeLast();
-    client.redirectReceived(*handle, WTFMove(redirectPair.first), WTFMove(redirectPair.second), [handle = WTFMove(handle), client = &client, redirectsInReverseOrder = WTFMove(redirectsInReverseOrder), completionHandler = WTFMove(completionHandler)] (ResourceRequest&&) mutable {
+    client.redirectReceived(*handle, WTFMove(redirectPair.first), WTFMove(redirectPair.second), [handle = WTFMove(handle), client = WeakPtr { client }, redirectsInReverseOrder = WTFMove(redirectsInReverseOrder), completionHandler = WTFMove(completionHandler)] (ResourceRequest&&) mutable {
         // Ignore the new request because we can't do anything with it.
         // We're just replying a redirect chain that has already happened.
+        if (!client)
+            return completionHandler({ });
         iterateRedirects(WTFMove(handle), *client, WTFMove(redirectsInReverseOrder), WTFMove(completionHandler));
     });
@@ -168 +170 @@
         redirectsInReverseOrder.uncheckedAppend(std::make_pair(pair.m_request, pair.m_redirectResponse));
     }
-    iterateRedirects(CachedResourceHandle<CachedRawResource>(this), client, WTFMove(redirectsInReverseOrder), [this, protectedThis = CachedResourceHandle<CachedRawResource>(this), client = &client] (ResourceRequest&&) mutable {
-        if (!hasClient(*client))
+    iterateRedirects(CachedResourceHandle<CachedRawResource>(this), client, WTFMove(redirectsInReverseOrder), [this, protectedThis = CachedResourceHandle<CachedRawResource>(this), client = WeakPtr { client }] (ResourceRequest&&) mutable {
+        if (!client || !hasClient(*client))
             return;
         auto responseProcessedHandler = [this, protectedThis = WTFMove(protectedThis), client] {
-            if (!hasClient(*client))
+            if (!client || !hasClient(*client))
                 return;
             if (m_data) {
                 m_data->forEachSegmentAsSharedBuffer([&](auto&& buffer) {
-                    if (hasClient(*client))
+                    if (!client || hasClient(*client))
                         client->dataReceived(*this, buffer);
                 });
             }
-            if (!hasClient(*client))
+            if (!client || !hasClient(*client))
                 return;
             CachedResource::didAddClient(*client);