Changeset 259080 in webkit

Timestamp:

Mar 26, 2020 2:33:33 PM (4 years ago)

Author:

Chris Dumez

Message:

[ Mac wk1] ASSERTION FAILED: m_wrapper under WebCore::XMLHttpRequestUpload::dispatchProgressEvent
​https://bugs.webkit.org/show_bug.cgi?id=209560
<rdar://problem/60887773>

Reviewed by Geoffrey Garen.

XMLHttpRequest::hasPendingActivity() was returning false if the XMLHttpRequest object did not
have any relevant event listeners. However, the XMLHttpRequestUpload's wrapper lifetime is tried
to the lifetime of its XMLHttpRequest wrapper. As a result, both the XMLHttpRequest and
XMLHttpRequestUpload wrappers could get garbage collected if the XMLHttpRequest did not have a
relevant listener, even though XMLHttpRequestUpload may have a relevant event listeners. We would
then hit the assertion when trying to fire an event on this XMLHttpRequestUpload object.

To address the issue, we update XMLHttpRequest::hasPendingActivity() to return false if both
XMLHttpRequest AND XMLHttpRequestUpload have no relevant event listeners.

No new tests, covered by imported/w3c/web-platform-tests/xhr/send-response-upload-event-progress.htm

• xml/XMLHttpRequest.cpp:

(WebCore::XMLHttpRequest::hasPendingActivity const):

• xml/XMLHttpRequestUpload.cpp:

(WebCore::XMLHttpRequestUpload::eventListenersDidChange):

• xml/XMLHttpRequestUpload.h:

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• xml/XMLHttpRequest.cpp (modified) (1 diff)
• xml/XMLHttpRequestUpload.cpp (modified) (1 diff)
• xml/XMLHttpRequestUpload.h (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-03-26  Chris Dumez  <cdumez@apple.com>
+
+        [ Mac wk1] ASSERTION FAILED: m_wrapper under WebCore::XMLHttpRequestUpload::dispatchProgressEvent
+        https://bugs.webkit.org/show_bug.cgi?id=209560
+        <rdar://problem/60887773>
+
+        Reviewed by Geoffrey Garen.
+
+        XMLHttpRequest::hasPendingActivity() was returning false if the XMLHttpRequest object did not
+        have any relevant event listeners. However, the XMLHttpRequestUpload's wrapper lifetime is tried
+        to the lifetime of its XMLHttpRequest wrapper. As a result, both the XMLHttpRequest and
+        XMLHttpRequestUpload wrappers could get garbage collected if the XMLHttpRequest did not have a
+        relevant listener, even though XMLHttpRequestUpload may have a relevant event listeners. We would
+        then hit the assertion when trying to fire an event on this XMLHttpRequestUpload object.
+
+        To address the issue, we update XMLHttpRequest::hasPendingActivity() to return false if both
+        XMLHttpRequest AND XMLHttpRequestUpload have no relevant event listeners.
+
+        No new tests, covered by imported/w3c/web-platform-tests/xhr/send-response-upload-event-progress.htm
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::hasPendingActivity const):
+        * xml/XMLHttpRequestUpload.cpp:
+        (WebCore::XMLHttpRequestUpload::eventListenersDidChange):
+        * xml/XMLHttpRequestUpload.h:
+
 2020-03-26  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/WebCore/xml/XMLHttpRequest.cpp

@@ -1183 +1183 @@
         return true;
 
-    if (!m_hasRelevantEventListener)
+    if (!m_hasRelevantEventListener && !(m_upload && m_upload->hasRelevantEventListener()))
         return false;
 

trunk/Source/WebCore/xml/XMLHttpRequestUpload.cpp

@@ -42 +42 @@
 }
 
+void XMLHttpRequestUpload::eventListenersDidChange()
+{
+    m_hasRelevantEventListener = hasEventListeners(eventNames().abortEvent)
+        || hasEventListeners(eventNames().errorEvent)
+        || hasEventListeners(eventNames().loadEvent)
+        || hasEventListeners(eventNames().loadendEvent)
+        || hasEventListeners(eventNames().loadstartEvent)
+        || hasEventListeners(eventNames().progressEvent)
+        || hasEventListeners(eventNames().timeoutEvent);
+}
+
 void XMLHttpRequestUpload::dispatchProgressEvent(const AtomString& type, unsigned long long loaded, unsigned long long total)
 {

trunk/Source/WebCore/xml/XMLHttpRequestUpload.h

@@ -41 +41 @@
     void dispatchProgressEvent(const AtomString& type, unsigned long long loaded, unsigned long long total);
 
+    bool hasRelevantEventListener() const { return m_hasRelevantEventListener; }
+
 private:
+    // EventTarget.
+    void eventListenersDidChange() final;
     void refEventTarget() final { ref(); }
     void derefEventTarget() final { deref(); }
@@ -49 +53 @@
 
     XMLHttpRequest& m_request;
+    bool m_hasRelevantEventListener { false };
 };