Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 071edf4eff8a34c0b083684cc82afded846f8b3a
https://github.com/WebKit/WebKit/commit/071edf4eff8a34c0b083684cc82afded846f8b3a
Author: Chris Dumez <[email protected]>
Date: 2026-05-12 (Tue, 12 May 2026)
Changed paths:
M Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp
M Source/WebKit/NetworkProcess/NetworkResourceLoader.h
Log Message:
-----------
RELEASE ASSERT:
http/tests/security/contentSecurityPolicy/multipart-three-part.py is a flaky
crash
https://bugs.webkit.org/show_bug.cgi?id=314243
rdar://169360779
Reviewed by Brent Fulgham and Brady Eidson.
http/tests/security/contentSecurityPolicy/multipart-three-part.py is
flaky because NetworkResourceLoader::didReceiveResponse() sometimes
overwrites m_responseCompletionHandler before the previous one has been
called, hitting the CompletionHandler destructor assertion.
For a multipart/x-mixed-replace main resource, the network layer can
deliver follow-up parts via didReceiveResponse() before the WebProcess
has answered ContinueDidReceiveResponse for the first part. The first
part's round-trip is async because it goes through
DocumentLoader::responseReceived() -> checkContentPolicy(), which IPCs
to the UIProcess. Assigning the new completion handler over the still-
pending one destroyed it without invoking it, asserting in
CompletionHandler's destructor.
Replace the single m_responseCompletionHandler with a Deque so each
incoming response queues its own handler, and each ContinueDidReceive-
Response IPC drains the front of the queue. This mirrors the WebProcess
flow (it processes each part in order, sending one ContinueDidReceive-
Response per approved part), so per-part validation is preserved. On
loader teardown / convertToDownload, any remaining handlers are drained
with PolicyAction::Ignore.
No new tests, covered by existing test.
* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:
(WebKit::NetworkResourceLoader::~NetworkResourceLoader):
(WebKit::NetworkResourceLoader::convertToDownload):
(WebKit::NetworkResourceLoader::transferToNewWebProcess):
(WebKit::NetworkResourceLoader::didReceiveResponse):
(WebKit::NetworkResourceLoader::continueDidReceiveResponse):
* Source/WebKit/NetworkProcess/NetworkResourceLoader.h:
Canonical link: https://commits.webkit.org/313118@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
