Bug 185088 - Fix crash in DocumentLoader::startLoadingMainResource
Summary: Fix crash in DocumentLoader::startLoadingMainResource
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Keith Rollin
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2018-04-27 13:44 PDT by Keith Rollin
Modified: 2018-04-27 18:09 PDT (History)
7 users (show)

See Also:

Attachments
Patch (2.26 KB, patch)
2018-04-27 13:51 PDT, Keith Rollin 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Keith Rollin 2018-04-27 13:44:23 PDT 
Testing turned up a crash in:

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x0000000312612e26 WebCore::DocumentLoader::startLoadingMainResource(WebCore::ShouldContinue) + 598
1   com.apple.WebCore             	0x00000003126321d0 WebCore::FrameLoader::continueLoadAfterNavigationPolicy(WebCore::ResourceRequest const&, WebCore::FormState*, WebCore::ShouldContinue, WebCore::AllowNavigationToInvalidURL)::$_14::operator()() const + 352

This corresponds to this source:

    if (maybeLoadEmpty()) {
        RELEASE_LOG_IF_ALLOWED("startLoadingMainResource: Returning empty document (frame = %p, main = %d)", m_frame, m_frame ? m_frame->isMainFrame() : false);
        return;
    }

The problem is that maybeLoadEmpty() can release "this". Fix this by adding a "protectedThis".

<rdar://problem/39689263>
Comment 1 Keith Rollin 2018-04-27 13:51:51 PDT 
Created attachment 339019 [details]
Patch
Comment 2 WebKit Commit Bot 2018-04-27 18:09:16 PDT 
Comment on attachment 339019 [details]
Patch

Clearing flags on attachment: 339019

Committed r231128: <https://trac.webkit.org/changeset/231128>
Comment 3 WebKit Commit Bot 2018-04-27 18:09:18 PDT 
All reviewed patches have been landed.  Closing bug.