Changeset 86200 in webkit

Timestamp:

May 10, 2011 5:46:02 PM (13 years ago)

Author:

psolanki@apple.com

Message:

Protect self in [WebCoreResourceHandleAsDelegate connection:didReceiveDataArray:]
​https://bugs.webkit.org/show_bug.cgi?id=60594
<rdar://problem/9203259>

Reviewed by Alexey Proskuryakov.

No tests since we don't have any bots testing CFNETWORK_DATA_ARRAY_CALLBACK.

• platform/network/mac/ResourceHandleMac.mm:

(-[WebCoreResourceHandleAsDelegate connection:didReceiveDataArray:]): The didReceiveData()
callback on client can result in the load being cancelled. This results in the delegate
(self) being freed. Protect self during the loop so we can check for m_handle and safely
return without crashing.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/network/mac/ResourceHandleMac.mm (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-05-10  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Protect self in [WebCoreResourceHandleAsDelegate connection:didReceiveDataArray:]
+        https://bugs.webkit.org/show_bug.cgi?id=60594
+        <rdar://problem/9203259>
+
+        No tests since we don't have any bots testing CFNETWORK_DATA_ARRAY_CALLBACK.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveDataArray:]): The didReceiveData()
+        callback on client can result in the load being cancelled. This results in the delegate
+        (self) being freed.  Protect self during the loop so we can check for m_handle and safely
+        return without crashing.
+
 2011-05-10  Chris Guillory  <chris.guillory@google.com>
 

trunk/Source/WebCore/platform/network/mac/ResourceHandleMac.mm

@@ -827 +827 @@
         m_handle->client()->didReceiveDataArray(m_handle, reinterpret_cast<CFArrayRef>(dataArray));
     else {
-        for (NSData *data in dataArray)
+        // The call to didReceiveData below could cancel a load, which would result in the delegate
+        // (self) being released.
+        RetainPtr<WebCoreResourceHandleAsDelegate> protect(self);
+        for (NSData *data in dataArray) {
+            if (!m_handle)
+                break;
             m_handle->client()->didReceiveData(m_handle, static_cast<const char*>([data bytes]), [data length], static_cast<int>([data length]));
+        }
     }
     return;