Changeset 245756 in webkit

Timestamp:

May 24, 2019 3:13:02 PM (5 years ago)

Author:

david_quesada@apple.com

Message:

Crash under WebCore::TimerBase::~TimerBase after a download is canceled
​https://bugs.webkit.org/show_bug.cgi?id=197927
rdar://problem/50822728

Reviewed by Ryosuke Niwa.

• NetworkProcess/Downloads/cocoa/DownloadCocoa.mm:

(WebKit::Download::platformCancelNetworkLoad):

CFNetwork makes no guarantees about what thread is used to call the completion block
passed to -[NSURLSessionDownloadTask cancelByProducingResumeData], and in some cases,
it can be called on a background queue. This eventually causes the Download to be
deallocated on the background queue, which triggers a release assertion failure in
~TimerBase. When CFNetwork finishes canceling the download, we should move to the
main thread before calling didCancel().

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• NetworkProcess/Downloads/cocoa/DownloadCocoa.mm (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-05-24  David Quesada  <david_quesada@apple.com>
+
+        Crash under WebCore::TimerBase::~TimerBase after a download is canceled
+        https://bugs.webkit.org/show_bug.cgi?id=197927
+        rdar://problem/50822728
+
+        Reviewed by Ryosuke Niwa.
+
+        * NetworkProcess/Downloads/cocoa/DownloadCocoa.mm:
+        (WebKit::Download::platformCancelNetworkLoad):
+            CFNetwork makes no guarantees about what thread is used to call the completion block
+            passed to -[NSURLSessionDownloadTask cancelByProducingResumeData], and in some cases,
+            it can be called on a background queue. This eventually causes the Download to be
+            deallocated on the background queue, which triggers a release assertion failure in
+            ~TimerBase. When CFNetwork finishes canceling the download, we should move to the
+            main thread before calling didCancel().
+
 2019-05-24  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebKit/NetworkProcess/Downloads/cocoa/DownloadCocoa.mm

@@ -82 +82 @@
     ASSERT(m_downloadTask);
     [m_downloadTask cancelByProducingResumeData:^(NSData *resumeData) {
-        if (resumeData && resumeData.bytes && resumeData.length)
-            didCancel(IPC::DataReference(reinterpret_cast<const uint8_t*>(resumeData.bytes), resumeData.length));
-        else
-            didCancel({ });
+        callOnMainThread([this, resumeData = retainPtr(resumeData)] {
+            if (resumeData && resumeData.get().bytes && resumeData.get().length)
+                didCancel(IPC::DataReference(reinterpret_cast<const uint8_t*>(resumeData.get().bytes), resumeData.get().length));
+            else
+                didCancel({ });
+        });
     }];
 }