Changeset 259580 in webkit

Timestamp:

Apr 6, 2020 11:08:21 AM (4 years ago)

Author:

dino@apple.com

Message:

CrashTracer: MobileSafari at WebKit: WebKit::SystemPreviewController::updateProgress
​https://bugs.webkit.org/show_bug.cgi?id=210040
rdar://51410841

Reviewed by Darin Adler.

It appears that the SystemPreviewController on WebPageProxy can
become null causing a call to an in-progress download to crash
as it tries to talk to the QuickLook delegate. Guard against this
by checking the SystemPreviewController each time.

• UIProcess/Cocoa/DownloadClient.mm:

(WebKit::systemPreviewController):
(WebKit::DownloadClient::didReceiveResponse):
(WebKit::DownloadClient::didReceiveData):
(WebKit::DownloadClient::processDidCrash):
(WebKit::DownloadClient::didFinish):
(WebKit::DownloadClient::didFail):
(WebKit::DownloadClient::didCancel):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/Cocoa/DownloadClient.mm (modified) (7 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2020-04-06  Dean Jackson  <dino@apple.com>
+
+        CrashTracer: MobileSafari at WebKit: WebKit::SystemPreviewController::updateProgress
+        https://bugs.webkit.org/show_bug.cgi?id=210040
+        rdar://51410841
+
+        Reviewed by Darin Adler.
+
+        It appears that the SystemPreviewController on WebPageProxy can
+        become null causing a call to an in-progress download to crash
+        as it tries to talk to the QuickLook delegate. Guard against this
+        by checking the SystemPreviewController each time.
+
+        * UIProcess/Cocoa/DownloadClient.mm:
+        (WebKit::systemPreviewController):
+        (WebKit::DownloadClient::didReceiveResponse):
+        (WebKit::DownloadClient::didReceiveData):
+        (WebKit::DownloadClient::processDidCrash):
+        (WebKit::DownloadClient::didFinish):
+        (WebKit::DownloadClient::didFail):
+        (WebKit::DownloadClient::didCancel):
+
 2020-04-06  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebKit/UIProcess/Cocoa/DownloadClient.mm

@@ -66 +66 @@
 }
 
+#if USE(SYSTEM_PREVIEW)
+static SystemPreviewController* systemPreviewController(DownloadProxy& downloadProxy)
+{
+    auto* page = downloadProxy.originatingPage();
+    if (!page)
+        return nullptr;
+    return page->systemPreviewController();
+}
+#endif
+
 void DownloadClient::didStart(DownloadProxy& downloadProxy)
 {
@@ -89 +99 @@
         downloadProxy.setExpectedContentLength(response.expectedContentLength());
         downloadProxy.setBytesLoaded(0);
-        if (auto* webPage = downloadProxy.originatingPage())
-            webPage->systemPreviewController()->updateProgress(0);
+        if (auto* controller = systemPreviewController(downloadProxy))
+            controller->updateProgress(0);
         return;
     }
@@ -104 +114 @@
     if (downloadProxy.isSystemPreviewDownload()) {
         downloadProxy.setBytesLoaded(downloadProxy.bytesLoaded() + length);
-        if (auto* webPage = downloadProxy.originatingPage())
-            webPage->systemPreviewController()->updateProgress(static_cast<float>(downloadProxy.bytesLoaded()) / downloadProxy.expectedContentLength());
+        if (auto* controller = systemPreviewController(downloadProxy))
+            controller->updateProgress(static_cast<float>(downloadProxy.bytesLoaded()) / downloadProxy.expectedContentLength());
         return;
     }
@@ -165 +175 @@
 #if USE(SYSTEM_PREVIEW)
     if (downloadProxy.isSystemPreviewDownload()) {
-        if (auto* webPage = downloadProxy.originatingPage())
-            webPage->systemPreviewController()->cancel();
+        if (auto* controller = systemPreviewController(downloadProxy))
+            controller->cancel();
         releaseActivityTokenIfNecessary(downloadProxy);
         return;
@@ -210 +220 @@
 #if USE(SYSTEM_PREVIEW)
     if (downloadProxy.isSystemPreviewDownload()) {
-        if (auto* webPage = downloadProxy.originatingPage()) {
+        if (auto* controller = systemPreviewController(downloadProxy)) {
             WTF::URL destinationURL = WTF::URL::fileURLWithFileSystemPath(downloadProxy.destinationFilename());
             if (!destinationURL.fragmentIdentifier().length())
                 destinationURL.setFragmentIdentifier(downloadProxy.request().url().fragmentIdentifier());
-            webPage->systemPreviewController()->finish(destinationURL);
+            controller->finish(destinationURL);
         }
         releaseActivityTokenIfNecessary(downloadProxy);
@@ -229 +239 @@
 #if USE(SYSTEM_PREVIEW)
     if (downloadProxy.isSystemPreviewDownload()) {
-        if (auto* webPage = downloadProxy.originatingPage())
-            webPage->systemPreviewController()->fail(error);
+        if (auto* controller = systemPreviewController(downloadProxy))
+            controller->fail(error);
         releaseActivityTokenIfNecessary(downloadProxy);
         return;
@@ -244 +254 @@
 #if USE(SYSTEM_PREVIEW)
     if (downloadProxy.isSystemPreviewDownload()) {
-        if (auto* webPage = downloadProxy.originatingPage())
-            webPage->systemPreviewController()->cancel();
+        if (auto* controller = systemPreviewController(downloadProxy))
+            controller->cancel();
         releaseActivityTokenIfNecessary(downloadProxy);
         return;