[Webkit-unassigned] [Bug 155515] New: [Win] Correct double-release of CFURLConnectionRef

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Tue Mar 15 15:14:38 PDT 2016


            Bug ID: 155515
           Summary: [Win] Correct double-release of CFURLConnectionRef
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: PC
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebKit Misc.
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: bfulgham at webkit.org

A double-release of a CFURLConnectionRef was identified in one of the WebDownload::init methods:

    CFURLConnectionRef connection = handle->connection();


    m_download = adoptCF(CFURLDownloadCreateAndStartWithLoadingConnection(0, connection, request.cfURLRequest(UpdateHTTPBody), response.cfURLResponse(), &client));


    // The CFURLDownload either starts successfully and retains the CFURLConnection, 
    // or it fails to creating and we have a now-useless connection with a dangling ref. 
    // Either way, we need to release the connection to balance out ref counts

The last line, the call to CFRelease(connection), is wrong and should be removed, because ResourceHandle::connection() just does 


CFURLDownloadCreateAndStartWithLoadingConnection() can retain the connection per the comment, while ResourceHandle:: releaseConnectionForDownload() lets go of the connection.

But then we release the connection via the raw pointer we stole from the ResourceHandle, as if we thought ResourceHandle::connection() returned a retained connection!

You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160315/daaed2ae/attachment.html>

More information about the webkit-unassigned mailing list