[webkit-changes] [233842] trunk/Source/WebKit

[carlosgc]

Title: [233842] trunk/Source/WebKit

Revision

233842

Author

carlo...@webkit.org

Date

2018-07-15 22:22:36 -0700 (Sun, 15 Jul 2018)

Log Message

[SOUP] http/tests/misc/bubble-drag-events.html crashes
https://bugs.webkit.org/show_bug.cgi?id=182352

Reviewed by Youenn Fablet.

PingLoad is not refcounted and deletes itself when the load finishes. The problem is that the network data
task can also finish the load, causing the PingLoad to be deleted early. We tried to fix it in r233032 in the
network data task soup implementation, but it caused regressions.

* NetworkProcess/PingLoad.cpp:
(WebKit::PingLoad::didReceiveChallenge): Create a weak ref for the ping load before calling the operation completion
handler and return early after the completion handler if it was deleted.
(WebKit::PingLoad::didReceiveResponseNetworkSession): Ditto.
* NetworkProcess/PingLoad.h:
* NetworkProcess/soup/NetworkDataTaskSoup.cpp:
(WebKit::NetworkDataTaskSoup::continueAuthenticate): Revert r233032.

Modified Paths

• trunk/Source/WebKit/ChangeLog
• trunk/Source/WebKit/NetworkProcess/PingLoad.cpp
• trunk/Source/WebKit/NetworkProcess/PingLoad.h
• trunk/Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp

Diff

Modified: trunk/Source/WebKit/ChangeLog (233841 => 233842)

--- trunk/Source/WebKit/ChangeLog	2018-07-16 05:19:42 UTC (rev 233841)
+++ trunk/Source/WebKit/ChangeLog	2018-07-16 05:22:36 UTC (rev 233842)
@@ -1,3 +1,22 @@
+2018-07-15  Carlos Garcia Campos  <cgar...@igalia.com>
+
+        [SOUP] http/tests/misc/bubble-drag-events.html crashes
+        https://bugs.webkit.org/show_bug.cgi?id=182352
+
+        Reviewed by Youenn Fablet.
+
+        PingLoad is not refcounted and deletes itself when the load finishes. The problem is that the network data
+        task can also finish the load, causing the PingLoad to be deleted early. We tried to fix it in r233032 in the
+        network data task soup implementation, but it caused regressions.
+
+        * NetworkProcess/PingLoad.cpp:
+        (WebKit::PingLoad::didReceiveChallenge): Create a weak ref for the ping load before calling the operation completion
+        handler and return early after the completion handler if it was deleted.
+        (WebKit::PingLoad::didReceiveResponseNetworkSession): Ditto.
+        * NetworkProcess/PingLoad.h:
+        * NetworkProcess/soup/NetworkDataTaskSoup.cpp:
+        (WebKit::NetworkDataTaskSoup::continueAuthenticate): Revert r233032.
+
 2018-07-13  Timothy Hatcher  <timo...@apple.com>
 
         Add _drawsBackground to WKWebViewConfiguration.

Modified: trunk/Source/WebKit/NetworkProcess/PingLoad.cpp (233841 => 233842)

--- trunk/Source/WebKit/NetworkProcess/PingLoad.cpp	2018-07-16 05:19:42 UTC (rev 233841)
+++ trunk/Source/WebKit/NetworkProcess/PingLoad.cpp	2018-07-16 05:22:36 UTC (rev 233842)
@@ -114,7 +114,10 @@
 void PingLoad::didReceiveChallenge(const AuthenticationChallenge&, ChallengeCompletionHandler&& completionHandler)
 {
     RELEASE_LOG_IF_ALLOWED("didReceiveChallenge");
+    auto weakThis = makeWeakPtr(*this);
     completionHandler(AuthenticationChallengeDisposition::Cancel, { });
+    if (!weakThis)
+        return;
     didFinish(ResourceError { String(), 0, currentURL(), "Failed HTTP authentication"_s, ResourceError::Type::AccessControl });
 }
 
@@ -121,7 +124,10 @@
 void PingLoad::didReceiveResponseNetworkSession(ResourceResponse&& response, ResponseCompletionHandler&& completionHandler)
 {
     RELEASE_LOG_IF_ALLOWED("didReceiveResponseNetworkSession - httpStatusCode: %d", response.httpStatusCode());
+    auto weakThis = makeWeakPtr(*this);
     completionHandler(PolicyAction::Ignore);
+    if (!weakThis)
+        return;
     didFinish({ }, response);
 }
 

Modified: trunk/Source/WebKit/NetworkProcess/PingLoad.h (233841 => 233842)

--- trunk/Source/WebKit/NetworkProcess/PingLoad.h	2018-07-16 05:19:42 UTC (rev 233841)
+++ trunk/Source/WebKit/NetworkProcess/PingLoad.h	2018-07-16 05:22:36 UTC (rev 233842)
@@ -31,6 +31,7 @@
 #include <WebCore/ResourceResponse.h>
 #include <wtf/CompletionHandler.h>
 #include <wtf/UniqueRef.h>
+#include <wtf/WeakPtr.h>
 
 namespace WebCore {
 class ContentSecurityPolicy;
@@ -43,7 +44,7 @@
 class NetworkConnectionToWebProcess;
 class NetworkLoadChecker;
 
-class PingLoad final : private NetworkDataTaskClient {
+class PingLoad final : public CanMakeWeakPtr<PingLoad>, private NetworkDataTaskClient {
 public:
     PingLoad(NetworkResourceLoadParameters&&, CompletionHandler<void(const WebCore::ResourceError&, const WebCore::ResourceResponse&)>&&);
     

Modified: trunk/Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp (233841 => 233842)

--- trunk/Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp	2018-07-16 05:19:42 UTC (rev 233841)
+++ trunk/Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp	2018-07-16 05:22:36 UTC (rev 233842)
@@ -527,7 +527,8 @@
         }
 
         if (disposition == AuthenticationChallengeDisposition::Cancel) {
-            invalidateAndCancel();
+            cancel();
+            didFail(cancelledError(m_soupRequest.get()));
             return;
         }
 

_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes