2009-02-20 Gustavo Noronha Silva <gns@gnome.org>

        Reviewed by Holger Freyther.

        Protect the ResourceHandle instance from being destroyed by
        didReceiveData inside the GIO readCallback call, so that
        cancelling caused by scripts is handled correctly.

        * platform/network/soup/ResourceHandleSoup.cpp:
        (WebCore::readCallback):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@41110 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 6cf644de1645a008204939f0d06e7867ec4ae2c1..d875bd493aab54e386af14f9905c2ba67b1025f8 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,14 @@
+2009-02-20  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Protect the ResourceHandle instance from being destroyed by
+        didReceiveData inside the GIO readCallback call, so that
+        cancelling caused by scripts is handled correctly.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::readCallback):
+
 2009-02-20  David Kilzer  <ddkilzer@apple.com>
 
         Make IconDatabaseNone.cpp compile with -Wunused and pass check-for-exit-time-destructors

diff --git a/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/WebCore/platform/network/soup/ResourceHandleSoup.cpp
index 57cb884a732245292bae23097321322446a953ac..189c2157c363c577ba4418d33dcc08d7480537ff 100644 (file)
--- a/WebCore/platform/network/soup/ResourceHandleSoup.cpp
+++ b/WebCore/platform/network/soup/ResourceHandleSoup.cpp
@@ -604,7 +604,8 @@ static void closeCallback(GObject* source, GAsyncResult* res, gpointer)
 
 static void readCallback(GObject* source, GAsyncResult* res, gpointer)
 {
-    ResourceHandle* handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
+    // didReceiveData may cancel the load, which may release the last reference.
+    RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
     if (!handle)
         return;
 
@@ -623,7 +624,7 @@ static void readCallback(GObject* source, GAsyncResult* res, gpointer)
     if (error) {
         ResourceError resourceError = networkErrorForFile(d->m_gfile, error);
         cleanupGioOperation(d);
-        client->didFail(handle, resourceError);
+        client->didFail(handle.get(), resourceError);
         return;
     } else if (!nread) {
         g_input_stream_close_async(d->m_input_stream, G_PRIORITY_DEFAULT,
@@ -632,7 +633,12 @@ static void readCallback(GObject* source, GAsyncResult* res, gpointer)
     }
 
     d->m_total += nread;
-    client->didReceiveData(handle, d->m_buffer, nread, d->m_total);
+    client->didReceiveData(handle.get(), d->m_buffer, nread, d->m_total);
+
+    if (d->m_cancelled) {
+        cleanupGioOperation(d);
+        return;
+    }
 
     g_input_stream_read_async(d->m_input_stream, d->m_buffer, d->m_bufsize,
                               G_PRIORITY_DEFAULT, d->m_cancellable,