Bug 219853

Summary: Remove FrameLoader::cancelAndClear
Product: WebKit Reporter: Rob Buis <rbuis>
Component: Page LoadingAssignee: Rob Buis <rbuis>
Status: RESOLVED FIXED    
Severity: Normal CC: achristensen, beidson, cdumez, ews-watchlist, japhet, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Patch none

Description Rob Buis 2020-12-14 07:11:18 PST
Remove FrameLoader::cancelAndClear.
Comment 1 Rob Buis 2020-12-14 07:19:53 PST
Created attachment 416154 [details]
Patch
Comment 2 Alex Christensen 2020-12-14 11:56:11 PST
Comment on attachment 416154 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=416154&action=review

> Source/WebCore/page/Frame.h:340
> +    FrameLoader* m_loader;

We don't want to increase the storage of raw pointers.  This is how use-after-free bugs arise.
Comment 3 Rob Buis 2020-12-15 07:46:03 PST
Created attachment 416245 [details]
Patch
Comment 4 Rob Buis 2020-12-15 14:25:47 PST
Comment on attachment 416154 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=416154&action=review

>> Source/WebCore/page/Frame.h:340
>> +    FrameLoader* m_loader;
> 
> We don't want to increase the storage of raw pointers.  This is how use-after-free bugs arise.

That is a good rule. It is just a pity that the smart pointers do not work well in this case, i.e call the destructor but keep the inner raw pointer around while the destructor is in process. Anyway, I found an alternative approach.
Comment 5 EWS 2020-12-15 23:34:03 PST
Committed r270881: <https://trac.webkit.org/changeset/270881>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 416245 [details].
Comment 6 Radar WebKit Bug Importer 2020-12-17 14:11:42 PST
<rdar://problem/72440511>