Changeset 246660 in webkit for trunk/Source/WebKit/UIProcess/WebURLSchemeTask.cpp

Timestamp:

Jun 20, 2019, 3:52:06 PM (6 years ago)

Author:

[email protected]

Message:

WebURLSchemeHandlerProxy::loadSynchronously crash with sync request.
<rdar://problem/51862206> and ​https://bugs.webkit.org/show_bug.cgi?id=199063

Reviewed by Geoffrey Garen.

Don't use a DataReference for the sync reply type.

• UIProcess/WebPageProxy.messages.in:
• UIProcess/WebURLSchemeHandler.h:

• UIProcess/WebURLSchemeTask.cpp:

(WebKit::WebURLSchemeTask::didComplete):

• UIProcess/WebURLSchemeTask.h:

• WebProcess/WebPage/WebURLSchemeHandlerProxy.cpp:

(WebKit::WebURLSchemeHandlerProxy::loadSynchronously):

File:

• trunk/Source/WebKit/UIProcess/WebURLSchemeTask.cpp (modified) (1 diff)

trunk/Source/WebKit/UIProcess/WebURLSchemeTask.cpp

@@ -137 +137 @@
     
     if (isSync()) {
-        IPC::DataReference data;
-        if (m_syncData)
-            data = { reinterpret_cast<const uint8_t*>(m_syncData->data()), m_syncData->size() };
-        m_syncCompletionHandler(m_syncResponse, error, data);
+        Vector<char> data;
+        if (m_syncData) {
+            data.resize(m_syncData->size());
+            memcpy(data.data(), reinterpret_cast<const char*>(m_syncData->data()), m_syncData->size());
+        }
+
+        m_syncCompletionHandler(m_syncResponse, error, WTFMove(data));
         m_syncData = nullptr;
     }