Bug 55958

Summary: Crash in CFNetwork visiting google.com
Product: WebKit Reporter: Jessie Berlin <jberlin>
Component: WebKit2Assignee: Jessie Berlin <jberlin>
Status: RESOLVED FIXED    
Severity: Normal CC: andersca, aroben, jberlin, sam
Priority: P2 Keywords: InRadar, PlatformOnly
Version: 528+ (Nightly build)   
Hardware: All   
OS: Windows 7   
Attachments:
Description Flags
Patch
none
Patch with a test none

Description Jessie Berlin 2011-03-08 12:04:34 PST 
The crash occurs when trying to copy a CFURLResponseRef in WKURLResponseCopyCFURLResponse that is null underneath WebCore::MainResourceLoader::handleEmptyLoad.

Since the load is empty, it is reasonable for the CFURLResponseRef to be null, and we should not try to copy a null CFURLResponseRef.

<rdar://problem/9102016>
Comment 1 Jessie Berlin 2011-03-08 12:15:44 PST 
Created attachment 85077 [details]
Patch
Comment 2 Jessie Berlin 2011-03-08 13:24:25 PST 
Created attachment 85085 [details]
Patch with a test
Comment 3 Jessie Berlin 2011-03-08 13:44:08 PST 
Comment on attachment 85085 [details]
Patch with a test

Committed in r80586
http://trac.webkit.org/changeset/80586
Comment 4 Adam Roben (:aroben) 2011-03-08 14:17:39 PST 
Comment on attachment 85085 [details]
Patch with a test

View in context: https://bugs.webkit.org/attachment.cgi?id=85085&action=review

> Tools/TestWebKitAPI/Tests/WebKit2/win/DoNotCopyANullCFURLResponse.cpp:38
> +    WKRetainPtr<WKURLResponseRef> nullWKResponse = WKURLResponseCreateWithCFURLResponse(0);
> +    RetainPtr<CFURLResponseRef> nullCFResponse = WKURLResponseCopyCFURLResponse(kCFAllocatorDefault, nullWKResponse.get());

Both of these are being leaked.
Comment 5 Jessie Berlin 2011-03-08 15:44:09 PST 
(In reply to comment #4)
> (From update of attachment 85085 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=85085&action=review
> 
> > Tools/TestWebKitAPI/Tests/WebKit2/win/DoNotCopyANullCFURLResponse.cpp:38
> > +    WKRetainPtr<WKURLResponseRef> nullWKResponse = WKURLResponseCreateWithCFURLResponse(0);
> > +    RetainPtr<CFURLResponseRef> nullCFResponse = WKURLResponseCopyCFURLResponse(kCFAllocatorDefault, nullWKResponse.get());
> 
> Both of these are being leaked.

Fixed in r80599
http://trac.webkit.org/changeset/80599