Bug 55958 - Crash in CFNetwork visiting google.com
Summary: Crash in CFNetwork visiting google.com
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit2 (show other bugs)
Version: 528+ (Nightly build)
Hardware: All Windows 7
: P2 Normal
Assignee: Jessie Berlin
URL:
Keywords: InRadar, PlatformOnly
Depends on:
Blocks:
 
Reported: 2011-03-08 12:04 PST by Jessie Berlin
Modified: 2011-03-08 15:44 PST (History)
4 users (show)

See Also:

Attachments
Patch (1.32 KB, patch)
2011-03-08 12:15 PST, Jessie Berlin 		no flags Details | Formatted Diff | Diff
Patch with a test (5.40 KB, patch)
2011-03-08 13:24 PST, Jessie Berlin 		no flags Details | Formatted Diff | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jessie Berlin 2011-03-08 12:04:34 PST 
The crash occurs when trying to copy a CFURLResponseRef in WKURLResponseCopyCFURLResponse that is null underneath WebCore::MainResourceLoader::handleEmptyLoad.

Since the load is empty, it is reasonable for the CFURLResponseRef to be null, and we should not try to copy a null CFURLResponseRef.

<rdar://problem/9102016>
Comment 1 Jessie Berlin 2011-03-08 12:15:44 PST 
Created attachment 85077 [details]
Patch
Comment 2 Jessie Berlin 2011-03-08 13:24:25 PST 
Created attachment 85085 [details]
Patch with a test
Comment 3 Jessie Berlin 2011-03-08 13:44:08 PST 
Comment on attachment 85085 [details]
Patch with a test

Committed in r80586
http://trac.webkit.org/changeset/80586
Comment 4 Adam Roben (:aroben) 2011-03-08 14:17:39 PST 
Comment on attachment 85085 [details]
Patch with a test

View in context: https://bugs.webkit.org/attachment.cgi?id=85085&action=review

> Tools/TestWebKitAPI/Tests/WebKit2/win/DoNotCopyANullCFURLResponse.cpp:38
> +    WKRetainPtr<WKURLResponseRef> nullWKResponse = WKURLResponseCreateWithCFURLResponse(0);
> +    RetainPtr<CFURLResponseRef> nullCFResponse = WKURLResponseCopyCFURLResponse(kCFAllocatorDefault, nullWKResponse.get());

Both of these are being leaked.
Comment 5 Jessie Berlin 2011-03-08 15:44:09 PST 
(In reply to comment #4)
> (From update of attachment 85085 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=85085&action=review
> 
> > Tools/TestWebKitAPI/Tests/WebKit2/win/DoNotCopyANullCFURLResponse.cpp:38
> > +    WKRetainPtr<WKURLResponseRef> nullWKResponse = WKURLResponseCreateWithCFURLResponse(0);
> > +    RetainPtr<CFURLResponseRef> nullCFResponse = WKURLResponseCopyCFURLResponse(kCFAllocatorDefault, nullWKResponse.get());
> 
> Both of these are being leaked.

Fixed in r80599
http://trac.webkit.org/changeset/80599