Changeset 199105 in webkit

Timestamp:

Apr 6, 2016 10:44:42 AM (8 years ago)

Author:

jer.noble@apple.com

Message:

CRASH in -[WebCoreNSURLSession taskCompleted:]
​https://bugs.webkit.org/show_bug.cgi?id=156290

Reviewed by Eric Carlson.

Fixes currently flakily crashing http/tests/media tests.

Protect against -taskCompleted: being called multiple times by only calling
-taskCompleted: if the task's state is not yet NSURLSessionTaskStateCompleted.
Additionally, make sure to clear the task's session pointer when removing it
from _dataTasks, as this ensures a task that outlives its session does not
keep a pointer to a dealloc'd object.

• platform/network/cocoa/WebCoreNSURLSession.mm:

(-[WebCoreNSURLSession taskCompleted:]):
(-[WebCoreNSURLSessionDataTask _resource:loadFinishedWithError:]):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/network/cocoa/WebCoreNSURLSession.mm (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-04-06  Jer Noble  <jer.noble@apple.com>
+
+        CRASH in -[WebCoreNSURLSession taskCompleted:]
+        https://bugs.webkit.org/show_bug.cgi?id=156290
+
+        Reviewed by Eric Carlson.
+
+        Fixes currently flakily crashing http/tests/media tests.
+
+        Protect against -taskCompleted: being called multiple times by only calling
+        -taskCompleted: if the task's state is not yet NSURLSessionTaskStateCompleted.
+        Additionally, make sure to clear the task's session pointer when removing it
+        from _dataTasks, as this ensures a task that outlives its session does not
+        keep a pointer to a dealloc'd object.
+
+        * platform/network/cocoa/WebCoreNSURLSession.mm:
+        (-[WebCoreNSURLSession taskCompleted:]):
+        (-[WebCoreNSURLSessionDataTask _resource:loadFinishedWithError:]):
+
 2016-04-06  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/platform/network/cocoa/WebCoreNSURLSession.mm

@@ -112 +112 @@
 {
     ASSERT(_dataTasks.contains(task));
+    task.session = nil;
     _dataTasks.remove(task);
     if (!_dataTasks.isEmpty() || !_invalidated)
@@ -594 +595 @@
 {
     ASSERT_UNUSED(resource, &resource == _resource);
+    if (self.state == NSURLSessionTaskStateCompleted)
+        return;
+    self.state = NSURLSessionTaskStateCompleted;
+
     RetainPtr<WebCoreNSURLSessionDataTask> strongSelf { self };
     RetainPtr<NSError> strongError { error };