The problem code is the following: void WebURLSchemeHandlerProxy::loadSynchronously(ResourceLoadIdentifier loadIdentifier, const ResourceRequest& request, ResourceResponse& response, ResourceError& error, Vector<char>& data) { IPC::DataReference dataReference; if (!m_webPage.sendSync(Messages::WebPageProxy::LoadSynchronousURLSchemeTask(URLSchemeTaskParameters { m_identifier, loadIdentifier, request }), Messages::WebPageProxy::LoadSynchronousURLSchemeTask::Reply(response, error, dataReference))) { error = failedCustomProtocolSyncLoad(request); return; } data.resize(dataReference.size()); memcpy(data.data(), dataReference.data(), dataReference.size()); } The “IPC::DataReference dataReference;” just "reference" data from sendSync but not "copy" it. When the sendSync function pop stack, the data will be dealloc. So the dataReference get a wild pointer. Steps: 1、 Setup custom Scheme UCWKURLSchemeHandler *handler = [[UCWKURLSchemeHandler alloc] init]; [configuration setURLSchemeHandler:handler forURLScheme:@"uc"]; 2、enable "Malloc Scribble" debug Environment 3、set breakpoint at WebURLSchemeHandlerProxy::loadSynchronously at the line “ data.resize(dataReference.size());” 4、launch the iOS Simultaor 5、Send a *Sync* XMLHttpRequest with the custom scheme Result: check the value of “dataReference” You can see my Screen Shot. This is the same result at MacOS Version
Created attachment 372546 [details] Screen Shot
<rdar://problem/51934147>
Created attachment 372582 [details] Patch
Comment on attachment 372582 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=372582&action=review r=me > Source/WebKit/WebProcess/WebPage/WebURLSchemeHandlerProxy.cpp:67 > + data.shrink(0); Why shrink here?
Comment on attachment 372582 [details] Patch Clearing flags on attachment: 372582 Committed r246660: <https://trac.webkit.org/changeset/246660>
All reviewed patches have been landed. Closing bug.
(In reply to Geoffrey Garen from comment #4) > Comment on attachment 372582 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=372582&action=review > > r=me > > > Source/WebKit/WebProcess/WebPage/WebURLSchemeHandlerProxy.cpp:67 > > + data.shrink(0); > > Why shrink here? Sorry, saw the r=me in the email but missed the question. Agreed it's unnecessary. "Bad™" habit sanitizing out parameters gained for early CS profs.