NetworkDataTask is being ref'd / deref'd from several threads and is not ThreadSafeRefCounted. See the makeRef() calls below: void NetworkDataTaskCocoa::resume() { if (m_scheduledFailureType != NoFailure) m_failureTimer.startOneShot(0_s); auto& cocoaSession = static_cast<NetworkSessionCocoa&>(*m_session); if (cocoaSession.deviceManagementRestrictionsEnabled() && m_isForMainResourceNavigationForAnyFrame) { auto didDetermineDeviceRestrictionPolicyForURL = makeBlockPtr([this, protectedThis = makeRef(*this)](BOOL isBlocked) { callOnMainThread([this, protectedThis = makeRef(*this), isBlocked] { if (isBlocked) { scheduleFailure(RestrictedURLFailure); return; } [m_task resume]; }); });
cc'ing Tim as he added this code. I am still confirming if this can really get called on a background thread or if the callOnMainThread() call is merely to make things asynchronous.
(In reply to Chris Dumez from comment #1) > cc'ing Tim as he added this code. I am still confirming if this can really > get called on a background thread or if the callOnMainThread() call is > merely to make things asynchronous. Ouch, definitely not called on the main thread. There is indeed a bug here.
Created attachment 376712 [details] Patch
Comment on attachment 376712 [details] Patch r=me
Comment on attachment 376712 [details] Patch Clearing flags on attachment: 376712 Committed r248874: <https://trac.webkit.org/changeset/248874>
All reviewed patches have been landed. Closing bug.
<rdar://problem/54487810>