Title: [88197] branches/chromium/782
- Revision
- 88197
- Author
- [email protected]
- Date
- 2011-06-06 15:28:33 -0700 (Mon, 06 Jun 2011)
Log Message
Merge r87959 to chromium/782.
< rdar://problem/9539920> and https://bugs.webkit.org/show_bug.cgi?id=61950
Repro crash loading certain webarchives after r87566.
Reviewed by Oliver Hunt.
Source/WebCore:
Test: webarchive/loading/_javascript_-url-iframe-crash.html
* bindings/ScriptControllerBase.cpp:
(WebCore::ScriptController::executeIfJavaScriptURL): DocumentWriter::replaceDocument can
cause the DocumentLoader to be destroyed, so protect it with a Ref here.
LayoutTests:
* webarchive/loading/_javascript_-url-iframe-crash-expected.txt: Added.
* webarchive/loading/_javascript_-url-iframe-crash.html: Added.
* webarchive/loading/resources/_javascript_-url-iframe-crash.webarchive: Added.
Modified Paths
Added Paths
Diff
Copied: branches/chromium/782/LayoutTests/webarchive/loading/_javascript_-url-iframe-crash-expected.txt (from rev 87959, trunk/LayoutTests/webarchive/loading/_javascript_-url-iframe-crash-expected.txt) (0 => 88197)
--- branches/chromium/782/LayoutTests/webarchive/loading/_javascript_-url-iframe-crash-expected.txt (rev 0)
+++ branches/chromium/782/LayoutTests/webarchive/loading/_javascript_-url-iframe-crash-expected.txt 2011-06-06 22:28:33 UTC (rev 88197)
@@ -0,0 +1,17 @@
+main frame - didStartProvisionalLoadForFrame
+main frame - didCommitLoadForFrame
+main frame - willPerformClientRedirectToURL: resources/_javascript_-url-iframe-crash.webarchive
+main frame - didFinishDocumentLoadForFrame
+main frame - didFinishLoadForFrame
+main frame - didStartProvisionalLoadForFrame
+main frame - didCancelClientRedirectForFrame
+main frame - didCommitLoadForFrame
+frame "<!--framePath //<!--frame0-->-->" - didStartProvisionalLoadForFrame
+frame "<!--framePath //<!--frame0-->-->" - didFailProvisionalLoadWithError
+frame "<!--framePath //<!--frame0-->-->" - didFinishDocumentLoadForFrame
+frame "<!--framePath //<!--frame0-->-->" - didHandleOnloadEventsForFrame
+main frame - didFinishDocumentLoadForFrame
+main frame - didHandleOnloadEventsForFrame
+main frame - didFinishLoadForFrame
+Loading this webarchive with a "non-empty _javascript_ URL iframe" should not crash.
+
Copied: branches/chromium/782/LayoutTests/webarchive/loading/_javascript_-url-iframe-crash.html (from rev 87959, trunk/LayoutTests/webarchive/loading/_javascript_-url-iframe-crash.html) (0 => 88197)
--- branches/chromium/782/LayoutTests/webarchive/loading/_javascript_-url-iframe-crash.html (rev 0)
+++ branches/chromium/782/LayoutTests/webarchive/loading/_javascript_-url-iframe-crash.html 2011-06-06 22:28:33 UTC (rev 88197)
@@ -0,0 +1,10 @@
+<html>
+<script>
+ if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+ }
+
+ window.location="resources/_javascript_-url-iframe-crash.webarchive";
+</script>
+</html>
Copied: branches/chromium/782/LayoutTests/webarchive/loading/resources/_javascript_-url-iframe-crash.webarchive (from rev 87959, trunk/LayoutTests/webarchive/loading/resources/_javascript_-url-iframe-crash.webarchive)
(Binary files differ)
Modified: branches/chromium/782/Source/WebCore/bindings/ScriptControllerBase.cpp (88196 => 88197)
--- branches/chromium/782/Source/WebCore/bindings/ScriptControllerBase.cpp 2011-06-06 22:27:19 UTC (rev 88196)
+++ branches/chromium/782/Source/WebCore/bindings/ScriptControllerBase.cpp 2011-06-06 22:28:33 UTC (rev 88197)
@@ -117,7 +117,10 @@
if (shouldReplaceDocumentIfJavaScriptURL == ReplaceDocumentIfJavaScriptURL) {
// We're still in a frame, so there should be a DocumentLoader.
ASSERT(m_frame->document()->loader());
- if (DocumentLoader* loader = m_frame->document()->loader())
+
+ // DocumentWriter::replaceDocument can cause the DocumentLoader to get deref'ed and possible destroyed,
+ // so protect it with a RefPtr.
+ if (RefPtr<DocumentLoader> loader = m_frame->document()->loader())
loader->writer()->replaceDocument(scriptResult);
}
return true;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
