[webkit-changes] [91142] branches/chromium/782

Fri, 15 Jul 2011 19:08:36 -0700

Title: [91142] branches/chromium/782

Diff

Copied: branches/chromium/782/LayoutTests/fast/dom/Geolocation/remove-remote-context-in-error-callback-crash-expected.txt (from rev 90914, trunk/LayoutTests/fast/dom/Geolocation/remove-remote-context-in-error-callback-crash-expected.txt) (0 => 91142)


--- branches/chromium/782/LayoutTests/fast/dom/Geolocation/remove-remote-context-in-error-callback-crash-expected.txt	                        (rev 0)
+++ branches/chromium/782/LayoutTests/fast/dom/Geolocation/remove-remote-context-in-error-callback-crash-expected.txt	2011-07-16 02:08:27 UTC (rev 91142)
@@ -0,0 +1,10 @@
+Tests that we do not crash when a Geolocation request is made from a remote frame, which is then removed from the DOM in the error callback.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS Error callback invoked.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

Copied: branches/chromium/782/LayoutTests/fast/dom/Geolocation/remove-remote-context-in-error-callback-crash.html (from rev 90914, trunk/LayoutTests/fast/dom/Geolocation/remove-remote-context-in-error-callback-crash.html) (0 => 91142)


--- branches/chromium/782/LayoutTests/fast/dom/Geolocation/remove-remote-context-in-error-callback-crash.html	                        (rev 0)
+++ branches/chromium/782/LayoutTests/fast/dom/Geolocation/remove-remote-context-in-error-callback-crash.html	2011-07-16 02:08:27 UTC (rev 91142)
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href=""
+<script src=""
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src=""
+<script src=""
+</body>
+</html>

Copied: branches/chromium/782/LayoutTests/fast/dom/Geolocation/resources/remove-remote-context-in-error-callback-crash-inner.html (from rev 90914, trunk/LayoutTests/fast/dom/Geolocation/resources/remove-remote-context-in-error-callback-crash-inner.html) (0 => 91142)


--- branches/chromium/782/LayoutTests/fast/dom/Geolocation/resources/remove-remote-context-in-error-callback-crash-inner.html	                        (rev 0)
+++ branches/chromium/782/LayoutTests/fast/dom/Geolocation/resources/remove-remote-context-in-error-callback-crash-inner.html	2011-07-16 02:08:27 UTC (rev 91142)
@@ -0,0 +1,14 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+  <head>
+    <script>
+      function init() {
+          if (window.layoutTestController)
+              layoutTestController.setGeolocationPermission(false);
+          window.parent.onIframeReady()
+      }
+    </script>
+  </head>
+  <body _onload_="init()">
+  </body>
+</html>

Copied: branches/chromium/782/LayoutTests/fast/dom/Geolocation/script-tests/remove-remote-context-in-error-callback-crash.js (from rev 90914, trunk/LayoutTests/fast/dom/Geolocation/script-tests/remove-remote-context-in-error-callback-crash.js) (0 => 91142)


--- branches/chromium/782/LayoutTests/fast/dom/Geolocation/script-tests/remove-remote-context-in-error-callback-crash.js	                        (rev 0)
+++ branches/chromium/782/LayoutTests/fast/dom/Geolocation/script-tests/remove-remote-context-in-error-callback-crash.js	2011-07-16 02:08:27 UTC (rev 91142)
@@ -0,0 +1,31 @@
+description("Tests that we do not crash when a Geolocation request is made from a remote frame, which is then removed from the DOM in the error callback.");
+
+function gc() {
+    if (window.GCController) {
+        GCController.collect();
+        return;
+    }
+
+    for (var i = 0; i < 10000; i++)
+        new String(i);
+}
+
+function onIframeReady() {
+    // Make request from remote frame
+    iframe.contentWindow.navigator.geolocation.getCurrentPosition(function() {
+        testFailed('Success callback invoked unexpectedly');
+        finishJSTest();
+    }, function() {
+        testPassed('Error callback invoked.');
+        document.body.removeChild(iframe);
+        gc();
+        finishJSTest();
+    });
+}
+
+var iframe = document.createElement('iframe');
+iframe.src = '';
+document.body.appendChild(iframe);
+
+window.jsTestIsAsync = true;
+window.successfullyParsed = true;

Modified: branches/chromium/782/Source/WebCore/page/Geolocation.cpp (91141 => 91142)


--- branches/chromium/782/Source/WebCore/page/Geolocation.cpp	2011-07-16 02:04:00 UTC (rev 91141)
+++ branches/chromium/782/Source/WebCore/page/Geolocation.cpp	2011-07-16 02:08:27 UTC (rev 91142)
@@ -442,6 +442,9 @@
 
 void Geolocation::setIsAllowed(bool allowed)
 {
+    // Protect the Geolocation object from garbage collection during a callback.
+    RefPtr<Geolocation> protect(this);
+
     // This may be due to either a new position from the service, or a cached
     // position.
     m_allowGeolocation = allowed ? Yes : No;

Modified: branches/chromium/782/Source/WebCore/page/Geolocation.h (91141 => 91142)


--- branches/chromium/782/Source/WebCore/page/Geolocation.h	2011-07-16 02:04:00 UTC (rev 91141)
+++ branches/chromium/782/Source/WebCore/page/Geolocation.h	2011-07-16 02:08:27 UTC (rev 91142)
@@ -100,7 +100,7 @@
         void startTimerIfNeeded();
         void timerFired(Timer<GeoNotifier>*);
         
-        Geolocation* m_geolocation;
+        RefPtr<Geolocation> m_geolocation;
         RefPtr<PositionCallback> m_successCallback;
         RefPtr<PositionErrorCallback> m_errorCallback;
         RefPtr<PositionOptions> m_options;

_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes

Reply via email to