Merge r270021 - Protect WebSocketChannel before calling client methods

https://bugs.webkit.org/show_bug.cgi?id=216791

Patch by Carlos Garcia Campos <cgarcia@igalia.com> on 2020-11-19
Reviewed by Youenn Fablet.

Ensure we keep a reference to the WebSocketChannel before calling client methods that might close the channel.

* WebProcess/Network/WebSocketChannel.cpp:
(WebKit::WebSocketChannel::close):
(WebKit::WebSocketChannel::fail):
(WebKit::WebSocketChannel::didClose):
(WebKit::WebSocketChannel::resume):

Source/WebKit/ChangeLog

@@ -1,3 +1,18 @@
+2020-11-19  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Protect WebSocketChannel before calling client methods
+        https://bugs.webkit.org/show_bug.cgi?id=216791
+
+        Reviewed by Youenn Fablet.
+
+        Ensure we keep a reference to the WebSocketChannel before calling client methods that might close the channel.
+
+        * WebProcess/Network/WebSocketChannel.cpp:
+        (WebKit::WebSocketChannel::close):
+        (WebKit::WebSocketChannel::fail):
+        (WebKit::WebSocketChannel::didClose):
+        (WebKit::WebSocketChannel::resume):
+
 2020-11-13  Miguel Gomez  <magomez@igalia.com>
 
         [GTK][WPE] CSS backdrop overlay corners are not rounded on results.webkit.org

Source/WebKit/WebProcess/Network/WebSocketChannel.cpp

@@ -198,6 +198,9 @@ unsigned WebSocketChannel::bufferedAmount() const
 
 void WebSocketChannel::close(int code, const String& reason)
 {
+    // An attempt to send closing handshake may fail, which will get the channel closed and dereferenced.
+    auto protectedThis = makeRef(*this);
+
     m_isClosing = true;
     if (m_client)
         m_client->didStartClosingHandshake();
@@ -209,6 +212,9 @@ void WebSocketChannel::close(int code, const String& reason)
 
 void WebSocketChannel::fail(const String& reason)
 {
+    // The client can close the channel, potentially removing the last reference.
+    auto protectedThis = makeRef(*this);
+
     if (m_client)
         m_client->didReceiveMessageError();
 
@@ -322,6 +328,9 @@ void WebSocketChannel::didClose(unsigned short code, String&& reason)
 
     m_inspector.didCloseWebSocket(m_document.get());
 
+    // An attempt to send closing handshake may fail, which will get the channel closed and dereferenced.
+    auto protectedThis = makeRef(*this);
+
     bool receivedClosingHandshake = code != WebCore::WebSocketChannel::CloseEventCodeAbnormalClosure;
     if (receivedClosingHandshake)
         m_client->didStartClosingHandshake();
@@ -359,6 +368,7 @@ void WebSocketChannel::suspend()
 
 void WebSocketChannel::resume()
 {
+    auto protectedThis = makeRef(*this);
     m_isSuspended = false;
     while (!m_isSuspended && !m_pendingTasks.isEmpty())
         m_pendingTasks.takeFirst()();