Bug 113616 – Crash when "willSendRequest" causes the ResourceLoader to be cancelled.

• Component: WebKit2
• Status: RESOLVED FIXED

[Brady Eidson]

Crash when "willSendRequest" causes the ResourceLoader to be cancelled.

This can happen a lot of ways.  One example is with the url http://www.rackspace.com/blog/mathematics-cannot-be-patented-case-dismissed/ where an XHR fails a redirect check and therefore the loader is cancelled.

When the WebCore loader is cancelled, the WebResourceLoader is destroyed but then it tries to access freed objects.

This was only introduced with the asynchronous ResourceHandleClient model so it's very new.

By adding a RefPtr<> protector we avoid the crash completely.  By adding a "detachFromCoreLoader" to call when the WebCore loader is aborting we can avoid unnecessary messaging back to the NetworkProcess.

[Brady Eidson]

Created attachment 195811 [details]
Patch v1

[Alexey Proskuryakov]

Comment on attachment 195811 [details]
Patch v1

View in context: https://bugs.webkit.org/attachment.cgi?id=195811&action=review

> Source/WebKit2/WebProcess/Network/WebResourceLoadScheduler.cpp:161
> +    ASSERT(loader);
> +    if (!loader)
> +        return;

How strongly do you feel about this? We usually do not not add such checks without knowing that this actually happens, and waiting for reproducible cases.

[Brady Eidson]

(In reply to comment #2)
> (From update of attachment 195811 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=195811&action=review
> 
> > Source/WebKit2/WebProcess/Network/WebResourceLoadScheduler.cpp:161
> > +    ASSERT(loader);
> > +    if (!loader)
> > +        return;
> 
> How strongly do you feel about this? We usually do not not add such checks without knowing that this actually happens, and waiting for reproducible cases.

I don't feel strongly about it, I'll remove it. (leaving the ASSERT)

[Brady Eidson]

http://trac.webkit.org/changeset/147257