Modified: trunk/Source/WebCore/ChangeLog (233822 => 233823)
--- trunk/Source/WebCore/ChangeLog 2018-07-13 22:35:48 UTC (rev 233822)
+++ trunk/Source/WebCore/ChangeLog 2018-07-13 22:54:16 UTC (rev 233823)
@@ -1,3 +1,21 @@
+2018-07-13 Chris Dumez <[email protected]>
+
+ Crash under ApplicationCacheGroup::didFailLoadingEntry()
+ https://bugs.webkit.org/show_bug.cgi?id=187661
+ <rdar://problem/42179755>
+
+ Reviewed by Youenn Fablet.
+
+ If ApplicationCacheResourceLoader::create() fails synchronously with
+ ApplicationCacheResourceLoader::Error::CannotCreateResource error, then
+ m_entryLoader will be null when didFailLoadingEntry() is called. However,
+ didFailLoadingEntry() fails to null check m_entryLoader before using it.
+
+ * loader/appcache/ApplicationCacheGroup.cpp:
+ (WebCore::ApplicationCacheGroup::didFailLoadingEntry):
+ (WebCore::ApplicationCacheGroup::startLoadingEntry):
+ * loader/appcache/ApplicationCacheGroup.h:
+
2018-07-13 Alex Christensen <[email protected]>
Add release assertion to check thread in TimerBase::setNextFireTime
Modified: trunk/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp (233822 => 233823)
--- trunk/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp 2018-07-13 22:35:48 UTC (rev 233822)
+++ trunk/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp 2018-07-13 22:54:16 UTC (rev 233823)
@@ -538,7 +538,7 @@
startLoadingEntry();
}
-void ApplicationCacheGroup::didFailLoadingEntry(ApplicationCacheResourceLoader::Error error, const URL& entryURL)
+void ApplicationCacheGroup::didFailLoadingEntry(ApplicationCacheResourceLoader::Error error, const URL& entryURL, unsigned type)
{
// FIXME: We should get back the error from ApplicationCacheResourceLoader level.
ResourceError resourceError { error == ApplicationCacheResourceLoader::Error::CannotCreateResource ? ResourceError::Type::AccessControl : ResourceError::Type::General };
@@ -545,7 +545,6 @@
InspectorInstrumentation::didFailLoading(m_frame, m_frame->loader().documentLoader(), m_currentResourceIdentifier, resourceError);
- unsigned type = m_entryLoader->type();
URL url(entryURL);
url.removeFragmentIdentifier();
@@ -554,7 +553,7 @@
m_pendingEntries.remove(url);
if ((type & ApplicationCacheResource::Explicit) || (type & ApplicationCacheResource::Fallback)) {
- m_frame->document()->addConsoleMessage(MessageSource::AppCache, MessageLevel::Error, "Application Cache update failed, because " + url.stringCenterEllipsizedToLength() + (m_entryLoader->hasRedirection() ? " was redirected." : " could not be fetched."));
+ m_frame->document()->addConsoleMessage(MessageSource::AppCache, MessageLevel::Error, makeString("Application Cache update failed, because ", url.stringCenterEllipsizedToLength(), (m_entryLoader && m_entryLoader->hasRedirection() ? " was redirected." : " could not be fetched.")));
// Note that cacheUpdateFailed() can cause the cache group to be deleted.
cacheUpdateFailed();
return;
@@ -904,12 +903,13 @@
auto& documentLoader = *m_frame->loader().documentLoader();
auto requestURL = request.url();
- m_entryLoader = ApplicationCacheResourceLoader::create(m_pendingEntries.begin()->value, documentLoader.cachedResourceLoader(), WTFMove(request), [this, requestURL = WTFMove(requestURL)] (auto&& resourceOrError) {
+ unsigned type = m_pendingEntries.begin()->value;
+ m_entryLoader = ApplicationCacheResourceLoader::create(type, documentLoader.cachedResourceLoader(), WTFMove(request), [this, requestURL = WTFMove(requestURL), type] (auto&& resourceOrError) {
if (!resourceOrError.has_value()) {
auto error = resourceOrError.error();
if (error == ApplicationCacheResourceLoader::Error::Abort)
return;
- this->didFailLoadingEntry(error, requestURL);
+ this->didFailLoadingEntry(error, requestURL, type);
return;
}
Modified: trunk/Source/WebCore/loader/appcache/ApplicationCacheGroup.h (233822 => 233823)
--- trunk/Source/WebCore/loader/appcache/ApplicationCacheGroup.h 2018-07-13 22:35:48 UTC (rev 233822)
+++ trunk/Source/WebCore/loader/appcache/ApplicationCacheGroup.h 2018-07-13 22:54:16 UTC (rev 233823)
@@ -104,7 +104,7 @@
void didFinishLoadingManifest();
void didFailLoadingManifest(ApplicationCacheResourceLoader::Error);
- void didFailLoadingEntry(ApplicationCacheResourceLoader::Error, const URL&);
+ void didFailLoadingEntry(ApplicationCacheResourceLoader::Error, const URL&, unsigned type);
void didFinishLoadingEntry(const URL&);
void didReachMaxAppCacheSize();
