[Webkit-unassigned] [Bug 174753] New: [Mac WK2] Potential null deref in WKView if WebPageProxy callbacks are invalidated in -[WKView dealloc]

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=174753

            Bug ID: 174753
           Summary: [Mac WK2] Potential null deref in WKView if
                    WebPageProxy callbacks are invalidated in -[WKView
                    dealloc]
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebKit2
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: wenson_hsieh at apple.com

This code in WKView:

- (void)dealloc
{
    _data->_impl->page().setIconLoadingClient(nullptr);
    _data->_impl = nullptr;

    [_data release];
    _data = nil;

    [super dealloc];
}

...seems like it would be susceptible to the same problem described in https://bugs.webkit.org/show_bug.cgi?id=174751. If ~WebViewImpl is called after setting _data->_impl to nullptr and one of the pending callbacks that get invoked when invalidating the callback map calls on WKView to do some work involving the _data's _impl, we'll probably end up with a null deref.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20170722/9cfa174c/attachment.html>