From: kov@webkit.org <kov@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Fri, 20 Feb 2009 19:41:24 +0000 (+0000)
Subject: 2009-02-20  Gustavo Noronha Silva  <gns@gnome.org>
X-Git-Url: https://git.webkit.org/?p=WebKit-https.git;a=commitdiff_plain;h=6a69a482a68d75d5312563e641fd39806a6deee5;hp=b1a55ba6240cea08d11f16fe19b7c8d5ba9e1b93

2009-02-20  Gustavo Noronha Silva  <gns@gnome.org>

        Reviewed by Holger Freyther.

        Protect the ResourceHandle instance from being destroyed by
        didReceiveData inside the GIO readCallback call, so that
        cancelling caused by scripts is handled correctly.

        * platform/network/soup/ResourceHandleSoup.cpp:
        (WebCore::readCallback):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@41110 268f45cc-cd09-0410-ab3c-d52691b4dbfc
---

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 6cf644de1645..d875bd493aab 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,14 @@
+2009-02-20  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Protect the ResourceHandle instance from being destroyed by
+        didReceiveData inside the GIO readCallback call, so that
+        cancelling caused by scripts is handled correctly.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::readCallback):
+
 2009-02-20  David Kilzer  <ddkilzer@apple.com>
 
         Make IconDatabaseNone.cpp compile with -Wunused and pass check-for-exit-time-destructors
diff --git a/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/WebCore/platform/network/soup/ResourceHandleSoup.cpp
index 57cb884a7322..189c2157c363 100644
--- a/WebCore/platform/network/soup/ResourceHandleSoup.cpp
+++ b/WebCore/platform/network/soup/ResourceHandleSoup.cpp
@@ -604,7 +604,8 @@ static void closeCallback(GObject* source, GAsyncResult* res, gpointer)
 
 static void readCallback(GObject* source, GAsyncResult* res, gpointer)
 {
-    ResourceHandle* handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
+    // didReceiveData may cancel the load, which may release the last reference.
+    RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
     if (!handle)
         return;
 
@@ -623,7 +624,7 @@ static void readCallback(GObject* source, GAsyncResult* res, gpointer)
     if (error) {
         ResourceError resourceError = networkErrorForFile(d->m_gfile, error);
         cleanupGioOperation(d);
-        client->didFail(handle, resourceError);
+        client->didFail(handle.get(), resourceError);
         return;
     } else if (!nread) {
         g_input_stream_close_async(d->m_input_stream, G_PRIORITY_DEFAULT,
@@ -632,7 +633,12 @@ static void readCallback(GObject* source, GAsyncResult* res, gpointer)
     }
 
     d->m_total += nread;
-    client->didReceiveData(handle, d->m_buffer, nread, d->m_total);
+    client->didReceiveData(handle.get(), d->m_buffer, nread, d->m_total);
+
+    if (d->m_cancelled) {
+        cleanupGioOperation(d);
+        return;
+    }
 
     g_input_stream_read_async(d->m_input_stream, d->m_buffer, d->m_bufsize,
                               G_PRIORITY_DEFAULT, d->m_cancellable,