Crash under ResourceHandleCFURLConnectionDelegateWithOperationQueue::…

…didSendBodyData

https://bugs.webkit.org/show_bug.cgi?id=178279

Reviewed by Alex Christensen.

Check if the connection is valid before calling ResourceHandleClient::didSendData.

No new tests, covered by existing tests.

* platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp:
(WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didSendBodyData):


Canonical link: https://commits.webkit.org/194516@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@223309 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore/ChangeLog

@@ -1,3 +1,17 @@
+2017-10-13  Per Arne Vollan  <pvollan@apple.com>
+
+        Crash under ResourceHandleCFURLConnectionDelegateWithOperationQueue::didSendBodyData
+        https://bugs.webkit.org/show_bug.cgi?id=178279
+
+        Reviewed by Alex Christensen.
+
+        Check if the connection is valid before calling ResourceHandleClient::didSendData.
+
+        No new tests, covered by existing tests.
+
+        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp:
+        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didSendBodyData):
+
 2017-10-13  Brent Fulgham  <bfulgham@apple.com>
 
         CMD+R / CMD+Q keyboard shortcuts are treated as user interaction with page

Source/WebCore/platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp

@@ -347,7 +347,7 @@ void ResourceHandleCFURLConnectionDelegateWithOperationQueue::didSendBodyData(CF
 {
     auto work = [protectedThis = makeRef(*this), totalBytesWritten, totalBytesExpectedToWrite] () mutable {
         auto& handle = protectedThis->m_handle;
-        if (!protectedThis->hasHandle() || !handle->client())
+        if (!protectedThis->hasHandle() || !handle->client() || !handle->connection())
             return;
 
         LOG(Network, "CFNet - ResourceHandleCFURLConnectionDelegateWithOperationQueue::didSendBodyData(handle=%p) (%s)", handle, handle->firstRequest().url().string().utf8().data());