[Webkit-unassigned] [Bug 28405] New: [CURL] Crash For Cancelled Local Processing

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=28405

           Summary: [CURL] Crash For Cancelled Local Processing
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Windows XP
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebCore Misc.
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: bfulgham at webkit.org


The code in Curl's headerCallback processing is not automatically called when
processing local files.  This has led to a number of bugs (e.g., Bug 28312) in
the past.

The LayoutTest "fast/images/favicon-as-image.html" (among others) triggers a
bug in local file processing when the request is cancelled.  This can happen if
the local processing involves JavaScript code that modifies the window
location.

The correction is to check the state of the m_cancelled flag immediately after
performing the manual processing, and treating the cancelled state in the same
way as any cancelled processing occurring earlier in the routine.

This happens in two places:

1.  The writeCallback, where a cancelled request should cause a zero-value
return.
2.  The downloadTimerCallback, where a cancelled request should cause the job
to be removed and processing to continue.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.