Bug 51453 – [Qt] crash in QNetworkReplyHandler::sendResponseIfNeeded()

• Component: New Bugs
• Status: RESOLVED FIXED

[vasily]

While working with a 3rd-party html/js widget loaded into QWebView, I've experienced a crash in QNetworkReplyHandler::sendResponseIfNeeded().
The crash happens when this method tries to call m_reply->error(), while m_reply value is NULL.
(Qt 4.6: qnetworkreplyhandler.cpp line 262)
(WebKit Trac (Dec 22nd 2010): qnetworkreplyhandler.cpp line 352)

Please find full call stack (Qt 4.6 opensource) attached.

The problem was initially reproduced on Qt 4.6, later - confirmed on Qt 4.7, but is likely to be present also in latest qnetworkreplyhandler.cpp version retrieved on 22.12.2010 via WebKit Trac (http://trac.webkit.org/browser/trunk/WebCore/platform/network/qt/QNetworkReplyHandler.cpp).

Steps to reproduce are not available, unfortunately, as I'm not authorized to upload the problematic widget here.

Anyway, the crash can be fixed by adding a check whether m_reply value is NULL, prior to performing any actions on the pointer.

[vasily]

Created attachment 77193 [details]
Call stack for the crash

[Jan Erik Hanssen]

Created attachment 78068 [details]
Patch

Check if m_reply is NULL before using as suggested by the reporter

[Jan Erik Hanssen]

Comment on attachment 78068 [details]
Patch

Appears to need more investigation, clearing flags.

[Jan Erik Hanssen]

Created attachment 78114 [details]
Patch

The problem encountered with the manual test in this case is that emitting processQueuedItems() may cause the ResourceHandle that owns the current QNetworkReplyHandler to be destroyed, setting m_reply to 0. This patch checks if m_reply is 0 before using. This may be related to bug 51641

[Andreas Kling]

Comment on attachment 78114 [details]
Patch

r=me, and thanks for digging into this! :)

[WebKit Commit Bot]

Comment on attachment 78114 [details]
Patch

Clearing flags on attachment: 78114

Committed r75157: <http://trac.webkit.org/changeset/75157>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[WebKit Review Bot]

http://trac.webkit.org/changeset/75157 might have broken Leopard Intel Debug (Tests)