Modified: trunk/Source/WebCore/ChangeLog (195392 => 195393)
--- trunk/Source/WebCore/ChangeLog 2016-01-21 00:41:46 UTC (rev 195392)
+++ trunk/Source/WebCore/ChangeLog 2016-01-21 01:49:12 UTC (rev 195393)
@@ -1,3 +1,26 @@
+2016-01-20 David Kilzer <[email protected]>
+
+ ResourceHandleCFURLConnectionDelegateWithOperationQueue delegate methods don't NULL-check m_handle->client()
+ <https://webkit.org/b/152675>
+ <rdar://problem/24034044>
+
+ Reviewed by Brent Fulgham.
+
+ * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp:
+ (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didReceiveResponse):
+ (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didReceiveData):
+ (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didFinishLoading):
+ (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didFail):
+ (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::willCacheResponse):
+ (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didSendBodyData):
+ (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didReceiveDataArray):
+ - Add NULL check for m_handle->client() as is done in the
+ WebCoreResourceHandleAsOperationQueueDelegate class in
+ WebCoreResourceHandleAsOperationQueueDelegate.mm. (The NULL
+ check for -connection:didReceiveResponse: is currently
+ missing, but there are crashes there, too, that are covered by
+ Bug 152673.)
+
2016-01-20 Said Abou-Hallawa <[email protected]>
Use TinyLRUCache in caching the CGColorRef in WebCore::cachedCGColor()
Modified: trunk/Source/WebCore/platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp (195392 => 195393)
--- trunk/Source/WebCore/platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp 2016-01-21 00:41:46 UTC (rev 195392)
+++ trunk/Source/WebCore/platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp 2016-01-21 01:49:12 UTC (rev 195393)
@@ -133,7 +133,7 @@
RefPtr<ResourceHandleCFURLConnectionDelegateWithOperationQueue> protector(this);
dispatch_async(dispatch_get_main_queue(), ^{
- if (!protector->hasHandle()) {
+ if (!protector->hasHandle() || !m_handle->client()) {
continueDidReceiveResponse();
return;
}
@@ -172,7 +172,7 @@
CFRetain(data);
dispatch_async(dispatch_get_main_queue(), ^{
- if (protector->hasHandle()) {
+ if (protector->hasHandle() && m_handle->client()) {
LOG(Network, "CFNet - ResourceHandleCFURLConnectionDelegateWithOperationQueue::didReceiveData(handle=%p) (%s)", m_handle, m_handle->firstRequest().url().string().utf8().data());
m_handle->client()->didReceiveBuffer(m_handle, SharedBuffer::wrapCFData(data), originalLength);
@@ -188,7 +188,7 @@
// capture "this" by pointer value, and use a C++ lambda to prevent other unintentional capturing.
RefPtr<ResourceHandleCFURLConnectionDelegateWithOperationQueue> protector(this);
dispatch_async(dispatch_get_main_queue(), ^{
- if (!protector->hasHandle())
+ if (!protector->hasHandle() || !m_handle->client())
return;
LOG(Network, "CFNet - ResourceHandleCFURLConnectionDelegateWithOperationQueue::didFinishLoading(handle=%p) (%s)", m_handle, m_handle->firstRequest().url().string().utf8().data());
@@ -204,7 +204,7 @@
RefPtr<ResourceHandleCFURLConnectionDelegateWithOperationQueue> protector(this);
CFRetain(error);
dispatch_async(dispatch_get_main_queue(), ^{
- if (protector->hasHandle()) {
+ if (protector->hasHandle() && m_handle->client()) {
LOG(Network, "CFNet - ResourceHandleCFURLConnectionDelegateWithOperationQueue::didFail(handle=%p) (%s)", m_handle, m_handle->firstRequest().url().string().utf8().data());
m_handle->client()->didFail(m_handle, ResourceError(error));
@@ -221,7 +221,7 @@
RefPtr<ResourceHandleCFURLConnectionDelegateWithOperationQueue> protector(this);
dispatch_async(dispatch_get_main_queue(), ^{
- if (!protector->hasHandle()) {
+ if (!protector->hasHandle() || !m_handle->client()) {
continueWillCacheResponse(nullptr);
return;
}
@@ -257,7 +257,7 @@
// capture "this" by pointer value, and use a C++ lambda to prevent other unintentional capturing.
RefPtr<ResourceHandleCFURLConnectionDelegateWithOperationQueue> protector(this);
dispatch_async(dispatch_get_main_queue(), ^{
- if (!protector->hasHandle())
+ if (!protector->hasHandle() || !m_handle->client())
return;
LOG(Network, "CFNet - ResourceHandleCFURLConnectionDelegateWithOperationQueue::didSendBodyData(handle=%p) (%s)", m_handle, m_handle->firstRequest().url().string().utf8().data());
@@ -309,7 +309,7 @@
RefPtr<ResourceHandleCFURLConnectionDelegateWithOperationQueue> protector(this);
CFRetain(dataArray);
dispatch_async(dispatch_get_main_queue(), ^{
- if (protector->hasHandle()) {
+ if (protector->hasHandle() && m_handle->client()) {
LOG(Network, "CFNet - ResourceHandleCFURLConnectionDelegateWithOperationQueue::didSendBodyData(handle=%p) (%s)", m_handle, m_handle->firstRequest().url().string().utf8().data());
m_handle->client()->didReceiveBuffer(m_handle, SharedBuffer::wrapCFDataArray(dataArray), -1);
