[WK2] CRASH: EXC_BAD_ACCESS crash in WKContextGetInfoForInstalledPlugIns when the dispatch block is destroyed

[Remy Demarest]

After the dispatch_async block, when it is destroyed, I get a EXC_BAD_ACCESS crash because it tries to release the memory of the ImmutableArray.

[Remy Demarest]

Created attachment 201422 [details]
Patch

[Darin Adler]

Comment on attachment 201422 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=201422&action=review

> Source/WebKit2/ChangeLog:11
> +        * UIProcess/API/C/mac/WKContextPrivateMac.mm:
> +        (WKContextGetInfoForInstalledPlugIns): Add __block attribute to the array variable
> +        to remove the const flag in the block, and use .release().leakRef() rather than
> +        .get() to cleanup the array properly.

How is leakRef going to clean up the array properly? It will leak the array!

[Darin Adler]

Comment on attachment 201422 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=201422&action=review

> Source/WebKit2/UIProcess/API/C/mac/WKContextPrivateMac.mm:132
> -        block(toAPI(array.get()), 0);
> +        block(toAPI(array.release().leakRef()), 0);

I think you will get what you want with release().get(); release().leakRef() wrong.

[Anders Carlsson]

Yup, this is invalid.