200062 2019-07-23 16:56:06 -0700 Crash in WebContent process with custom schemes 2019-07-24 13:29:18 -0700 1 1 1 Unclassified WebKit WebKit Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 beidson beidson aestes commit-queue webkit-bug-importer oldest_to_newest 1555222 0 beidson 2019-07-23 16:56:06 -0700 Crash in WebContent process with customer schemes. WebKit: WebKit::WebURLSchemeTaskProxy::processNextPendingTask() <== WebKit: WebKit::WebURLSchemeHandlerProxy::taskDidReceiveData(unsigned long long, unsigned long, unsigned char const*) WebKit: WebKit::WebURLSchemeHandlerProxy::taskDidReceiveData(unsigned long long, unsigned long, unsigned char const*) WebKit: WebKit::WebPage::urlSchemeTaskDidReceiveData(unsigned long long, unsigned long long, IPC::DataReference const&) WebKit: WebKit::WebPage::didReceiveWebPageMessage(IPC::Connection&, IPC::Decoder&) Everywhere else in WebURLSchemeTaskProxy we protect it with a Ref before later calling processNextPendingTask. But not in didReceiveData. So lets do that. <rdar://problem/52968793> 1555225 1 374737 beidson 2019-07-23 17:04:15 -0700 Created attachment 374737 Patch 1555474 2 374737 commit-queue 2019-07-24 13:28:37 -0700 Comment on attachment 374737 Patch Clearing flags on attachment: 374737 Committed r247787: <https://trac.webkit.org/changeset/247787> 1555475 3 commit-queue 2019-07-24 13:28:38 -0700 All reviewed patches have been landed. Closing bug. 1555476 4 webkit-bug-importer 2019-07-24 13:29:18 -0700 <rdar://problem/53510380> 374737 2019-07-23 17:04:15 -0700 2019-07-24 13:28:37 -0700 Patch patch text/plain 1523 beidson ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nIGIvU291cmNlL1dlYktpdC9DaGFu Z2VMb2cKaW5kZXggMDM1YWYwNTdiODEuLjM3ZmFiZWVjZTk3IDEwMDY0NAotLS0gYS9Tb3VyY2Uv V2ViS2l0L0NoYW5nZUxvZworKysgYi9Tb3VyY2UvV2ViS2l0L0NoYW5nZUxvZwpAQCAtMSwzICsx LDE3IEBACisyMDE5LTA3LTIzICBCcmFkeSBFaWRzb24gIDxiZWlkc29uQGFwcGxlLmNvbT4KKwor ICAgICAgICBDcmFzaCBpbiBXZWJDb250ZW50IHByb2Nlc3Mgd2l0aCBjdXN0b20gc2NoZW1lcy4K KyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzUyOTY4NzkzPiBhbmQgaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTIwMDA2MgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgIEFsbW9zdCBldmVyeXdoZXJlIGluIFdlYlVSTFNjaGVtZVRh c2tQcm94eSB3aGVyZSB3ZSBjYWxsIHByb2Nlc3NOZXh0UGVuZGluZ1Rhc2soKSB3ZSBmaXJzdCBw cm90ZWN0IHRoZSB0YXNrIHdpdGggYSByZWYuCisgICAgICAgIEJ1dCBub3QgaW4gZGlkUmVjZWl2 ZURhdGEuCisgICAgICAgIFNvIGxldHMgZG8gdGhhdC4KKworICAgICAgICAqIFdlYlByb2Nlc3Mv V2ViUGFnZS9XZWJVUkxTY2hlbWVUYXNrUHJveHkuY3BwOgorICAgICAgICAoV2ViS2l0OjpXZWJV UkxTY2hlbWVUYXNrUHJveHk6OmRpZFJlY2VpdmVEYXRhKTogUHJvdGVjdCB0aGlzLgorCiAyMDE5 LTA3LTIzICBaYWxhbiBCdWp0YXMgIDx6YWxhbkBhcHBsZS5jb20+CiAKICAgICAgICAgW2lPU10g VGFwcGluZyB0aGUgc2VhcmNoIGZpZWxkIG9uIGEgc2VhcmNoIHJlc3VsdHMgcGFnZSBvbiB6aWxs b3cuY29tIHNob3dzIGFuZCBpbW1lZGlhdGVseSBkaXNtaXNzZXMgdGhlIGtleWJvYXJkCmRpZmYg LS1naXQgYS9Tb3VyY2UvV2ViS2l0L1dlYlByb2Nlc3MvV2ViUGFnZS9XZWJVUkxTY2hlbWVUYXNr UHJveHkuY3BwIGIvU291cmNlL1dlYktpdC9XZWJQcm9jZXNzL1dlYlBhZ2UvV2ViVVJMU2NoZW1l VGFza1Byb3h5LmNwcAppbmRleCA0MzZiNThmOWUzZS4uODE1MDE3MmYwZGIgMTAwNjQ0Ci0tLSBh L1NvdXJjZS9XZWJLaXQvV2ViUHJvY2Vzcy9XZWJQYWdlL1dlYlVSTFNjaGVtZVRhc2tQcm94eS5j cHAKKysrIGIvU291cmNlL1dlYktpdC9XZWJQcm9jZXNzL1dlYlBhZ2UvV2ViVVJMU2NoZW1lVGFz a1Byb3h5LmNwcApAQCAtMTI1LDYgKzEyNSw3IEBAIHZvaWQgV2ViVVJMU2NoZW1lVGFza1Byb3h5 OjpkaWRSZWNlaXZlRGF0YShzaXplX3Qgc2l6ZSwgY29uc3QgdWludDhfdCogZGF0YSkKICAgICAg ICAgcmV0dXJuOwogICAgIH0KIAorICAgIGF1dG8gcHJvdGVjdGVkVGhpcyA9IG1ha2VSZWYoKnRo aXMpOwogICAgIG1fY29yZUxvYWRlci0+ZGlkUmVjZWl2ZURhdGEocmVpbnRlcnByZXRfY2FzdDxj b25zdCBjaGFyKj4oZGF0YSksIHNpemUsIDAsIERhdGFQYXlsb2FkVHlwZTo6RGF0YVBheWxvYWRC eXRlcyk7CiAgICAgcHJvY2Vzc05leHRQZW5kaW5nVGFzaygpOwogfQo=