Changeset 167202 in webkit

Timestamp:

Apr 13, 2014 1:02:13 PM (10 years ago)

Author:

aestes@apple.com

Message:

REGRESSION (r167164): -[WKNSURLSessionLocal _getCookieHeadersForTask:completionHandler:] _block_invoke can access a deallocated completionHandler
​https://bugs.webkit.org/show_bug.cgi?id=131595

Reviewed by Dan Bernstein.

Make a copy of completionHandler and release it after we're done with it.

• Shared/mac/CookieStorageShim.mm:

(-[WKNSURLSessionLocal _getCookieHeadersForTask:completionHandler:]):

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• Shared/mac/CookieStorageShim.mm (modified) (2 diffs)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2014-04-13  Andy Estes  <aestes@apple.com>
+
+        REGRESSION (r167164): -[WKNSURLSessionLocal _getCookieHeadersForTask:completionHandler:] _block_invoke can access a deallocated completionHandler
+        https://bugs.webkit.org/show_bug.cgi?id=131595
+
+        Reviewed by Dan Bernstein.
+
+        Make a copy of completionHandler and release it after we're done with it.
+
+        * Shared/mac/CookieStorageShim.mm:
+        (-[WKNSURLSessionLocal _getCookieHeadersForTask:completionHandler:]):
+
 2014-04-13  Pratik Solanki  <psolanki@apple.com>
 

trunk/Source/WebKit2/Shared/mac/CookieStorageShim.mm

@@ -117 +117 @@
 
 #if PLATFORM(IOS) || __MAC_OS_X_VERSION_MIN_REQUIRED >= 1090
-- (void)_getCookieHeadersForTask:(NSURLSessionTask*)task completionHandler:(void (^)(CFDictionaryRef))completionHandler
+using CompletionHandlerBlock = void(^)(CFDictionaryRef);
+- (void)_getCookieHeadersForTask:(NSURLSessionTask*)task completionHandler:(CompletionHandlerBlock)completionHandler
 {
     if (!completionHandler)
@@ -123 +124 @@
 
     RetainPtr<NSURLSessionTask> strongTask = task;
-    RunLoop::main().dispatch([strongTask, completionHandler]{
-        completionHandler(WebKit::webKitCookieStorageCopyRequestHeaderFieldsForURL(nullptr, (CFURLRef)[[strongTask currentRequest] URL]));
+    CompletionHandlerBlock completionHandlerCopy = [completionHandler copy];
+    RunLoop::main().dispatch([strongTask, completionHandlerCopy]{
+        completionHandlerCopy(WebKit::webKitCookieStorageCopyRequestHeaderFieldsForURL(nullptr, (CFURLRef)[[strongTask currentRequest] URL]));
+        [completionHandlerCopy release];
     });
 }