WebCoreResourceHandleAsOperationQueueDelegate/ResourceHandleCFURLConnectionDelegateWithOperationQueue may be deleted in main thread callback

• Component: Platform
• Status: RESOLVED FIXED

[Daniel Bates]

While investigating the assertion failure in bug #181746 I noticed that WebCoreResourceHandleAsOperationQueueDelegate does not retain itself before waiting on a main thread operation. The main thread operation can do anything, including detaching from WebCoreResourceHandleAsOperationQueueDelegate and deleting it. A PingHandle is one example of a resource handle that will delete itself as soon as possible => detach and delete its resource handle delegate (WebCoreResourceHandleAsOperationQueueDelegate). Specifically, a PingHandle will delete itself when the delegate queries (on the main thread) whether it can respond to an authentication request (a ping never responds to authentication requests) => WebCoreResourceHandleAsOperationQueueDelegate is deleted while it is waiting for the main thread to respond.

[Radar WebKit Bug Importer]

<rdar://problem/36588120>

[Daniel Bates]

Created attachment 331510 [details]
Patch

[Alex Christensen]

Comment on attachment 331510 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=331510&action=review

> Source/WebCore/platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:172
> +    auto protectedSelf = retainPtr(self);

I'm not sure if this one's necessary because it doesn't do anything with self after calling the function which, until it is sent to the main thread, has a protector inside it's lambda capture.

[Alex Christensen]

We should consider doing the same for the CFURLConnection code on Windows.

[Daniel Bates]

Comment on attachment 331510 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=331510&action=review

>> Source/WebCore/platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:172
>> +    auto protectedSelf = retainPtr(self);
> 
> I'm not sure if this one's necessary because it doesn't do anything with self after calling the function which, until it is sent to the main thread, has a protector inside it's lambda capture.

Oops! Will remove.

[Daniel Bates]

(In reply to Alex Christensen from comment #4)
> We should consider doing the same for the CFURLConnection code on Windows.

Will do before landing.

[Daniel Bates]

Committed r227073: <https://trac.webkit.org/changeset/227073>