64656 2011-07-16 15:00:33 -0700 SubresourceLoader::didReceiveDataArray can crash when calling m_client->didReceiveData() 2011-07-16 16:29:54 -0700 1 1 1 Unclassified WebKit Platform 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 psolanki psolanki psolanki oldest_to_newest 438182 0 psolanki 2011-07-16 15:00:33 -0700 SubresourceLoader::didReceiveDataArray() calls m_client->didReceiveData() in a loop. This can crash if m_client is deleted in an iteration. This is similar to bug 60594. 438184 1 psolanki 2011-07-16 15:01:14 -0700 <rdar://problem/9754425> 438186 2 101101 psolanki 2011-07-16 15:14:40 -0700 Created attachment 101101 Patch 438187 3 101101 ap 2011-07-16 15:23:35 -0700 Comment on attachment 101101 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=101101&action=review > Source/WebCore/loader/cf/SubresourceLoaderCF.cpp:47 > + if (!m_client) > + break; Please remove a check for m_client that you have above (if (!m_loadingMultipartContent && m_client)). 438202 4 psolanki 2011-07-16 16:29:54 -0700 Committed r91157: <http://trac.webkit.org/changeset/91157> 101101 2011-07-16 15:14:40 -0700 2011-07-16 15:23:35 -0700 Patch bug-64656-20110716151442.patch text/plain 1644 psolanki U3VidmVyc2lvbiBSZXZpc2lvbjogOTExMjAKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwppbmRleCA0ZDFjNDEzNTIwOWFlYTFi MGI1ZmYwNDExMzExZWEzZjg3OTc4ZjYzLi5iZDI4MGI5MTY5YjlhOTYzZjRmZTUxZmIwNjc5MGM4 ZDAyNGZjNDJkIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291 cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTQgQEAKKzIwMTEtMDctMTYgIFByYXRp ayBTb2xhbmtpICA8cHNvbGFua2lAYXBwbGUuY29tPgorCisgICAgICAgIFN1YnJlc291cmNlTG9h ZGVyOjpkaWRSZWNlaXZlRGF0YUFycmF5IGNhbiBjcmFzaCB3aGVuIGNhbGxpbmcgbV9jbGllbnQt PmRpZFJlY2VpdmVEYXRhKCkKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i dWcuY2dpP2lkPTY0NjU2CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisK KyAgICAgICAgKiBsb2FkZXIvY2YvU3VicmVzb3VyY2VMb2FkZXJDRi5jcHA6CisgICAgICAgIChX ZWJDb3JlOjpTdWJyZXNvdXJjZUxvYWRlcjo6ZGlkUmVjZWl2ZURhdGFBcnJheSk6IENoZWNrIGZv ciBtX2NsaWVudCBiZWZvcmUgY2FsbGluZworICAgICAgICBtX2NsaWVudC0+ZGlkUmVjZWl2ZURh dGEoKS4KKwogMjAxMS0wNi0yNyAgQWRyaWVubmUgV2Fsa2VyICA8ZW5uZUBnb29nbGUuY29tPgog CiAgICAgICAgIFJldmlld2VkIGJ5IFNpbW9uIEZyYXNlci4KZGlmZiAtLWdpdCBhL1NvdXJjZS9X ZWJDb3JlL2xvYWRlci9jZi9TdWJyZXNvdXJjZUxvYWRlckNGLmNwcCBiL1NvdXJjZS9XZWJDb3Jl L2xvYWRlci9jZi9TdWJyZXNvdXJjZUxvYWRlckNGLmNwcAppbmRleCBmNmNlOTNmYTNiY2RmNmM1 ZjYxZTM1ZGI5MzNlMDYzZWQxYWM3YjNkLi41ZTM2NmJlNmVmM2M2NjFhYTg2ZGJhYTJjMjdhZDQ3 MmRjOTk1MTBiIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9sb2FkZXIvY2YvU3VicmVzb3Vy Y2VMb2FkZXJDRi5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvbG9hZGVyL2NmL1N1YnJlc291cmNl TG9hZGVyQ0YuY3BwCkBAIC00Myw2ICs0Myw4IEBAIHZvaWQgU3VicmVzb3VyY2VMb2FkZXI6OmRp ZFJlY2VpdmVEYXRhQXJyYXkoQ0ZBcnJheVJlZiBkYXRhQXJyYXkpCiAgICAgaWYgKCFtX2xvYWRp bmdNdWx0aXBhcnRDb250ZW50ICYmIG1fY2xpZW50KSB7CiAgICAgICAgIENGSW5kZXggYXJyYXlD b3VudCA9IENGQXJyYXlHZXRDb3VudChkYXRhQXJyYXkpOwogICAgICAgICBmb3IgKENGSW5kZXgg aSA9IDA7IGkgPCBhcnJheUNvdW50OyArK2kpICB7CisgICAgICAgICAgICBpZiAoIW1fY2xpZW50 KQorICAgICAgICAgICAgICAgIGJyZWFrOwogICAgICAgICAgICAgQ0ZEYXRhUmVmIGRhdGEgPSBy ZWludGVycHJldF9jYXN0PENGRGF0YVJlZj4oQ0ZBcnJheUdldFZhbHVlQXRJbmRleChkYXRhQXJy YXksIGkpKTsKICAgICAgICAgICAgIG1fY2xpZW50LT5kaWRSZWNlaXZlRGF0YSh0aGlzLCByZWlu dGVycHJldF9jYXN0PGNvbnN0IGNoYXIgKj4oQ0ZEYXRhR2V0Qnl0ZVB0cihkYXRhKSksIHN0YXRp Y19jYXN0PGludD4oQ0ZEYXRhR2V0TGVuZ3RoKGRhdGEpKSk7CiAgICAgICAgIH0K