| Summary: | WebURLSchemeHandlerProxy::loadSynchronously crash with sync request | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Jin <ljin.zq> | ||||||
| Component: | WebKit2 | Assignee: | Brady Eidson <beidson> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | Normal | CC: | achristensen, beidson, commit-queue, ggaren, webkit-bug-importer, youennf | ||||||
| Priority: | P2 | Keywords: | InRadar | ||||||
| Version: | Other | ||||||||
| Hardware: | iPhone / iPad | ||||||||
| OS: | iOS 12 | ||||||||
| Attachments: |
|
||||||||
Created attachment 372546 [details]
Screen Shot
Created attachment 372582 [details]
Patch
Comment on attachment 372582 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=372582&action=review r=me > Source/WebKit/WebProcess/WebPage/WebURLSchemeHandlerProxy.cpp:67 > + data.shrink(0); Why shrink here? Comment on attachment 372582 [details] Patch Clearing flags on attachment: 372582 Committed r246660: <https://trac.webkit.org/changeset/246660> All reviewed patches have been landed. Closing bug. (In reply to Geoffrey Garen from comment #4) > Comment on attachment 372582 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=372582&action=review > > r=me > > > Source/WebKit/WebProcess/WebPage/WebURLSchemeHandlerProxy.cpp:67 > > + data.shrink(0); > > Why shrink here? Sorry, saw the r=me in the email but missed the question. Agreed it's unnecessary. "Bad™" habit sanitizing out parameters gained for early CS profs. |
The problem code is the following: void WebURLSchemeHandlerProxy::loadSynchronously(ResourceLoadIdentifier loadIdentifier, const ResourceRequest& request, ResourceResponse& response, ResourceError& error, Vector<char>& data) { IPC::DataReference dataReference; if (!m_webPage.sendSync(Messages::WebPageProxy::LoadSynchronousURLSchemeTask(URLSchemeTaskParameters { m_identifier, loadIdentifier, request }), Messages::WebPageProxy::LoadSynchronousURLSchemeTask::Reply(response, error, dataReference))) { error = failedCustomProtocolSyncLoad(request); return; } data.resize(dataReference.size()); memcpy(data.data(), dataReference.data(), dataReference.size()); } The “IPC::DataReference dataReference;” just "reference" data from sendSync but not "copy" it. When the sendSync function pop stack, the data will be dealloc. So the dataReference get a wild pointer. Steps: 1、 Setup custom Scheme UCWKURLSchemeHandler *handler = [[UCWKURLSchemeHandler alloc] init]; [configuration setURLSchemeHandler:handler forURLScheme:@"uc"]; 2、enable "Malloc Scribble" debug Environment 3、set breakpoint at WebURLSchemeHandlerProxy::loadSynchronously at the line “ data.resize(dataReference.size());” 4、launch the iOS Simultaor 5、Send a *Sync* XMLHttpRequest with the custom scheme Result： check the value of “dataReference” You can see my Screen Shot. This is the same result at MacOS Version