Title: [235562] trunk/Source
Revision
235562
Author
[email protected]
Date
2018-08-31 12:00:23 -0700 (Fri, 31 Aug 2018)

Log Message

Assertion hit in ~CompletionHandler() from ~WebFrame()
https://bugs.webkit.org/show_bug.cgi?id=189199
<rdar://problem/42657233>

Reviewed by Youenn Fablet.

Source/WebCore:

The issue was caused by WebFrame::m_willSubmitFormCompletionHandlers implicitly containing
CompletionHandlers (wrapped in WTF::Functions) and not calling them upon WebFrame
destruction.

No new tests, covered by fast/frames/iframe-target.html.

* loader/EmptyClients.cpp:
(WebCore::EmptyFrameLoaderClient::dispatchWillSubmitForm):
* loader/EmptyFrameLoaderClient.h:
* loader/FrameLoaderClient.h:

Source/WebKit:

* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
(WebKit::WebFrameLoaderClient::dispatchWillSubmitForm):
* WebProcess/WebCoreSupport/WebFrameLoaderClient.h:
* WebProcess/WebPage/WebFrame.cpp:
(WebKit::WebFrame::~WebFrame):
(WebKit::WebFrame::setUpWillSubmitFormListener):
(WebKit::WebFrame::invalidatePolicyListener):
* WebProcess/WebPage/WebFrame.h:

Source/WebKitLegacy/mac:

* WebCoreSupport/WebFrameLoaderClient.h:
* WebCoreSupport/WebFrameLoaderClient.mm:
(WebFrameLoaderClient::dispatchWillSubmitForm):

Source/WebKitLegacy/win:

* WebCoreSupport/WebFrameLoaderClient.cpp:
(WebFrameLoaderClient::dispatchWillSubmitForm):
* WebCoreSupport/WebFrameLoaderClient.h:

Modified Paths

Diff

Modified: trunk/Source/WebCore/ChangeLog (235561 => 235562)


--- trunk/Source/WebCore/ChangeLog	2018-08-31 18:07:46 UTC (rev 235561)
+++ trunk/Source/WebCore/ChangeLog	2018-08-31 19:00:23 UTC (rev 235562)
@@ -1,3 +1,22 @@
+2018-08-31  Chris Dumez  <[email protected]>
+
+        Assertion hit in ~CompletionHandler() from ~WebFrame()
+        https://bugs.webkit.org/show_bug.cgi?id=189199
+        <rdar://problem/42657233>
+
+        Reviewed by Youenn Fablet.
+
+        The issue was caused by WebFrame::m_willSubmitFormCompletionHandlers implicitly containing
+        CompletionHandlers (wrapped in WTF::Functions) and not calling them upon WebFrame
+        destruction.
+
+        No new tests, covered by fast/frames/iframe-target.html.
+
+        * loader/EmptyClients.cpp:
+        (WebCore::EmptyFrameLoaderClient::dispatchWillSubmitForm):
+        * loader/EmptyFrameLoaderClient.h:
+        * loader/FrameLoaderClient.h:
+
 2018-08-31  Zalan Bujtas  <[email protected]>
 
         [LFC] Add margin box verification back now that Display::Box has non-computed horizontal margin.

Modified: trunk/Source/WebCore/loader/EmptyClients.cpp (235561 => 235562)


--- trunk/Source/WebCore/loader/EmptyClients.cpp	2018-08-31 18:07:46 UTC (rev 235561)
+++ trunk/Source/WebCore/loader/EmptyClients.cpp	2018-08-31 19:00:23 UTC (rev 235562)
@@ -458,8 +458,9 @@
 {
 }
 
-void EmptyFrameLoaderClient::dispatchWillSubmitForm(FormState&, WTF::Function<void(void)>&&)
+void EmptyFrameLoaderClient::dispatchWillSubmitForm(FormState&, CompletionHandler<void()>&& completionHandler)
 {
+    completionHandler();
 }
 
 Ref<DocumentLoader> EmptyFrameLoaderClient::createDocumentLoader(const ResourceRequest& request, const SubstituteData& substituteData)

Modified: trunk/Source/WebCore/loader/EmptyFrameLoaderClient.h (235561 => 235562)


--- trunk/Source/WebCore/loader/EmptyFrameLoaderClient.h	2018-08-31 18:07:46 UTC (rev 235561)
+++ trunk/Source/WebCore/loader/EmptyFrameLoaderClient.h	2018-08-31 19:00:23 UTC (rev 235562)
@@ -101,7 +101,7 @@
     void dispatchUnableToImplementPolicy(const ResourceError&) final { }
 
     void dispatchWillSendSubmitEvent(Ref<FormState>&&) final;
-    void dispatchWillSubmitForm(FormState&, WTF::Function<void(void)>&&) final;
+    void dispatchWillSubmitForm(FormState&, CompletionHandler<void()>&&) final;
 
     void revertToProvisionalState(DocumentLoader*) final { }
     void setMainDocumentError(DocumentLoader*, const ResourceError&) final { }

Modified: trunk/Source/WebCore/loader/FrameLoader.cpp (235561 => 235562)


--- trunk/Source/WebCore/loader/FrameLoader.cpp	2018-08-31 18:07:46 UTC (rev 235561)
+++ trunk/Source/WebCore/loader/FrameLoader.cpp	2018-08-31 19:00:23 UTC (rev 235562)
@@ -3337,7 +3337,7 @@
         diagnosticLoggingClient.logDiagnosticMessageWithResult(DiagnosticLoggingKeys::pageCacheKey(), DiagnosticLoggingKeys::retrievalKey(), DiagnosticLoggingResultFail, ShouldSample::Yes);
     }
 
-    CompletionHandler<void(void)> completionHandler = [this, shouldContinue] {
+    CompletionHandler<void()> completionHandler = [this, shouldContinue] {
         if (!m_provisionalDocumentLoader)
             return;
         

Modified: trunk/Source/WebCore/loader/FrameLoaderClient.h (235561 => 235562)


--- trunk/Source/WebCore/loader/FrameLoaderClient.h	2018-08-31 18:07:46 UTC (rev 235561)
+++ trunk/Source/WebCore/loader/FrameLoaderClient.h	2018-08-31 19:00:23 UTC (rev 235562)
@@ -199,7 +199,7 @@
     virtual void dispatchUnableToImplementPolicy(const ResourceError&) = 0;
 
     virtual void dispatchWillSendSubmitEvent(Ref<FormState>&&) = 0;
-    virtual void dispatchWillSubmitForm(FormState&, WTF::Function<void(void)>&&) = 0;
+    virtual void dispatchWillSubmitForm(FormState&, CompletionHandler<void()>&&) = 0;
 
     virtual void revertToProvisionalState(DocumentLoader*) = 0;
     virtual void setMainDocumentError(DocumentLoader*, const ResourceError&) = 0;

Modified: trunk/Source/WebKit/ChangeLog (235561 => 235562)


--- trunk/Source/WebKit/ChangeLog	2018-08-31 18:07:46 UTC (rev 235561)
+++ trunk/Source/WebKit/ChangeLog	2018-08-31 19:00:23 UTC (rev 235562)
@@ -1,3 +1,20 @@
+2018-08-31  Chris Dumez  <[email protected]>
+
+        Assertion hit in ~CompletionHandler() from ~WebFrame()
+        https://bugs.webkit.org/show_bug.cgi?id=189199
+        <rdar://problem/42657233>
+
+        Reviewed by Youenn Fablet.
+
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit::WebFrameLoaderClient::dispatchWillSubmitForm):
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.h:
+        * WebProcess/WebPage/WebFrame.cpp:
+        (WebKit::WebFrame::~WebFrame):
+        (WebKit::WebFrame::setUpWillSubmitFormListener):
+        (WebKit::WebFrame::invalidatePolicyListener):
+        * WebProcess/WebPage/WebFrame.h:
+
 2018-08-31  Antti Koivisto  <[email protected]>
 
         Replace OptionSet |= and -= operators with add() and remove() functions

Modified: trunk/Source/WebKit/UIProcess/WebFormSubmissionListenerProxy.h (235561 => 235562)


--- trunk/Source/WebKit/UIProcess/WebFormSubmissionListenerProxy.h	2018-08-31 18:07:46 UTC (rev 235561)
+++ trunk/Source/WebKit/UIProcess/WebFormSubmissionListenerProxy.h	2018-08-31 19:00:23 UTC (rev 235562)
@@ -32,7 +32,7 @@
 
 class WebFormSubmissionListenerProxy : public API::ObjectImpl<API::Object::Type::FormSubmissionListener> {
 public:
-    static Ref<WebFormSubmissionListenerProxy> create(CompletionHandler<void(void)>&& completionHandler)
+    static Ref<WebFormSubmissionListenerProxy> create(CompletionHandler<void()>&& completionHandler)
     {
         return adoptRef(*new WebFormSubmissionListenerProxy(WTFMove(completionHandler)));
     }
@@ -40,10 +40,10 @@
     void continueSubmission();
 
 private:
-    WebFormSubmissionListenerProxy(CompletionHandler<void(void)>&& completionHandler)
+    WebFormSubmissionListenerProxy(CompletionHandler<void()>&& completionHandler)
         : m_completionHandler(WTFMove(completionHandler))
     { }
-    CompletionHandler<void(void)> m_completionHandler;
+    CompletionHandler<void()> m_completionHandler;
 };
 
 } // namespace WebKit

Modified: trunk/Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp (235561 => 235562)


--- trunk/Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp	2018-08-31 18:07:46 UTC (rev 235561)
+++ trunk/Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp	2018-08-31 19:00:23 UTC (rev 235562)
@@ -940,11 +940,13 @@
     webPage->injectedBundleFormClient().willSendSubmitEvent(webPage, &form, m_frame, sourceFrame, formState->textFieldValues());
 }
 
-void WebFrameLoaderClient::dispatchWillSubmitForm(FormState& formState, WTF::Function<void(void)>&& function)
+void WebFrameLoaderClient::dispatchWillSubmitForm(FormState& formState, CompletionHandler<void()>&& completionHandler)
 {
     WebPage* webPage = m_frame->page();
-    if (!webPage)
+    if (!webPage) {
+        completionHandler();
         return;
+    }
 
     auto& form = formState.form();
 
@@ -958,7 +960,7 @@
     RefPtr<API::Object> userData;
     webPage->injectedBundleFormClient().willSubmitForm(webPage, &form, m_frame, sourceFrame, values, userData);
 
-    uint64_t listenerID = m_frame->setUpWillSubmitFormListener(WTFMove(function));
+    uint64_t listenerID = m_frame->setUpWillSubmitFormListener(WTFMove(completionHandler));
 
     webPage->send(Messages::WebPageProxy::WillSubmitForm(m_frame->frameID(), sourceFrame->frameID(), values, listenerID, UserData(WebProcess::singleton().transformObjectsToHandles(userData.get()).get())));
 }

Modified: trunk/Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.h (235561 => 235562)


--- trunk/Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.h	2018-08-31 18:07:46 UTC (rev 235561)
+++ trunk/Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.h	2018-08-31 19:00:23 UTC (rev 235562)
@@ -131,7 +131,7 @@
     void dispatchUnableToImplementPolicy(const WebCore::ResourceError&) final;
     
     void dispatchWillSendSubmitEvent(Ref<WebCore::FormState>&&) final;
-    void dispatchWillSubmitForm(WebCore::FormState&, WTF::Function<void(void)>&&) final;
+    void dispatchWillSubmitForm(WebCore::FormState&, CompletionHandler<void()>&&) final;
     
     void revertToProvisionalState(WebCore::DocumentLoader*) final;
     void setMainDocumentError(WebCore::DocumentLoader*, const WebCore::ResourceError&) final;

Modified: trunk/Source/WebKit/WebProcess/WebPage/WebFrame.cpp (235561 => 235562)


--- trunk/Source/WebKit/WebProcess/WebPage/WebFrame.cpp	2018-08-31 18:07:46 UTC (rev 235561)
+++ trunk/Source/WebKit/WebProcess/WebPage/WebFrame.cpp	2018-08-31 19:00:23 UTC (rev 235562)
@@ -163,6 +163,10 @@
 {
     ASSERT(!m_coreFrame);
 
+    auto willSubmitFormCompletionHandlers = WTFMove(m_willSubmitFormCompletionHandlers);
+    for (auto& completionHandler : willSubmitFormCompletionHandlers.values())
+        completionHandler();
+
 #ifndef NDEBUG
     webFrameCounter.decrement();
 #endif
@@ -219,7 +223,7 @@
     return m_policyListenerID;
 }
 
-uint64_t WebFrame::setUpWillSubmitFormListener(WTF::Function<void(void)>&& completionHandler)
+uint64_t WebFrame::setUpWillSubmitFormListener(CompletionHandler<void()>&& completionHandler)
 {
     uint64_t identifier = generateListenerID();
     invalidatePolicyListener();
@@ -244,9 +248,10 @@
     if (auto function = std::exchange(m_policyFunction, nullptr))
         function(PolicyAction::Ignore);
     m_policyFunctionForNavigationAction = ForNavigationAction::No;
-    for (auto& function : m_willSubmitFormCompletionHandlers.values())
-        function();
-    m_willSubmitFormCompletionHandlers.clear();
+
+    auto willSubmitFormCompletionHandlers = WTFMove(m_willSubmitFormCompletionHandlers);
+    for (auto& completionHandler : willSubmitFormCompletionHandlers.values())
+        completionHandler();
 }
 
 void WebFrame::didReceivePolicyDecision(uint64_t listenerID, PolicyAction action, uint64_t navigationID, DownloadID downloadID, std::optional<WebsitePoliciesData>&& websitePolicies)

Modified: trunk/Source/WebKit/WebProcess/WebPage/WebFrame.h (235561 => 235562)


--- trunk/Source/WebKit/WebProcess/WebPage/WebFrame.h	2018-08-31 18:07:46 UTC (rev 235561)
+++ trunk/Source/WebKit/WebProcess/WebPage/WebFrame.h	2018-08-31 19:00:23 UTC (rev 235562)
@@ -89,7 +89,7 @@
     void invalidatePolicyListener();
     void didReceivePolicyDecision(uint64_t listenerID, WebCore::PolicyAction, uint64_t navigationID, DownloadID, std::optional<WebsitePoliciesData>&&);
 
-    uint64_t setUpWillSubmitFormListener(WTF::Function<void(void)>&&);
+    uint64_t setUpWillSubmitFormListener(CompletionHandler<void()>&&);
     void continueWillSubmitForm(uint64_t);
 
     void startDownload(const WebCore::ResourceRequest&, const String& suggestedName = { });
@@ -183,7 +183,7 @@
     uint64_t m_policyListenerID { 0 };
     WebCore::FramePolicyFunction m_policyFunction;
     ForNavigationAction m_policyFunctionForNavigationAction { ForNavigationAction::No };
-    HashMap<uint64_t, WTF::Function<void(void)>> m_willSubmitFormCompletionHandlers;
+    HashMap<uint64_t, CompletionHandler<void()>> m_willSubmitFormCompletionHandlers;
     DownloadID m_policyDownloadID { 0 };
 
     std::unique_ptr<WebFrameLoaderClient> m_frameLoaderClient;

Modified: trunk/Source/WebKitLegacy/mac/ChangeLog (235561 => 235562)


--- trunk/Source/WebKitLegacy/mac/ChangeLog	2018-08-31 18:07:46 UTC (rev 235561)
+++ trunk/Source/WebKitLegacy/mac/ChangeLog	2018-08-31 19:00:23 UTC (rev 235562)
@@ -1,3 +1,15 @@
+2018-08-31  Chris Dumez  <[email protected]>
+
+        Assertion hit in ~CompletionHandler() from ~WebFrame()
+        https://bugs.webkit.org/show_bug.cgi?id=189199
+        <rdar://problem/42657233>
+
+        Reviewed by Youenn Fablet.
+
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::dispatchWillSubmitForm):
+
 2018-08-31  Antti Koivisto  <[email protected]>
 
         Replace OptionSet |= and -= operators with add() and remove() functions

Modified: trunk/Source/WebKitLegacy/mac/WebCoreSupport/WebFrameLoaderClient.h (235561 => 235562)


--- trunk/Source/WebKitLegacy/mac/WebCoreSupport/WebFrameLoaderClient.h	2018-08-31 18:07:46 UTC (rev 235561)
+++ trunk/Source/WebKitLegacy/mac/WebCoreSupport/WebFrameLoaderClient.h	2018-08-31 19:00:23 UTC (rev 235562)
@@ -134,7 +134,7 @@
     void dispatchUnableToImplementPolicy(const WebCore::ResourceError&) final;
 
     void dispatchWillSendSubmitEvent(Ref<WebCore::FormState>&&) final;
-    void dispatchWillSubmitForm(WebCore::FormState&, WTF::Function<void(void)>&&) final;
+    void dispatchWillSubmitForm(WebCore::FormState&, CompletionHandler<void()>&&) final;
 
     void revertToProvisionalState(WebCore::DocumentLoader*) final;
     void setMainDocumentError(WebCore::DocumentLoader*, const WebCore::ResourceError&) final;

Modified: trunk/Source/WebKitLegacy/mac/WebCoreSupport/WebFrameLoaderClient.mm (235561 => 235562)


--- trunk/Source/WebKitLegacy/mac/WebCoreSupport/WebFrameLoaderClient.mm	2018-08-31 18:07:46 UTC (rev 235561)
+++ trunk/Source/WebKitLegacy/mac/WebCoreSupport/WebFrameLoaderClient.mm	2018-08-31 19:00:23 UTC (rev 235562)
@@ -949,16 +949,16 @@
     CallFormDelegate(getWebView(m_webFrame.get()), @selector(willSendSubmitEventToForm:inFrame:withValues:), formElement, m_webFrame.get(), values);
 }
 
-void WebFrameLoaderClient::dispatchWillSubmitForm(FormState& formState, WTF::Function<void(void)>&& function)
+void WebFrameLoaderClient::dispatchWillSubmitForm(FormState& formState, CompletionHandler<void()>&& completionHandler)
 {
     id <WebFormDelegate> formDelegate = [getWebView(m_webFrame.get()) _formDelegate];
     if (!formDelegate) {
-        function();
+        completionHandler();
         return;
     }
 
     NSDictionary *values = makeFormFieldValuesDictionary(formState);
-    CallFormDelegate(getWebView(m_webFrame.get()), @selector(frame:sourceFrame:willSubmitForm:withValues:submissionListener:), m_webFrame.get(), kit(formState.sourceDocument().frame()), kit(&formState.form()), values, setUpPolicyListener([function = WTFMove(function)](PolicyAction) { function(); }, PolicyAction::Ignore).get());
+    CallFormDelegate(getWebView(m_webFrame.get()), @selector(frame:sourceFrame:willSubmitForm:withValues:submissionListener:), m_webFrame.get(), kit(formState.sourceDocument().frame()), kit(&formState.form()), values, setUpPolicyListener([completionHandler = WTFMove(completionHandler)](PolicyAction) mutable { completionHandler(); }, PolicyAction::Ignore).get());
 }
 
 void WebFrameLoaderClient::revertToProvisionalState(DocumentLoader* loader)

Modified: trunk/Source/WebKitLegacy/win/ChangeLog (235561 => 235562)


--- trunk/Source/WebKitLegacy/win/ChangeLog	2018-08-31 18:07:46 UTC (rev 235561)
+++ trunk/Source/WebKitLegacy/win/ChangeLog	2018-08-31 19:00:23 UTC (rev 235562)
@@ -1,3 +1,15 @@
+2018-08-31  Chris Dumez  <[email protected]>
+
+        Assertion hit in ~CompletionHandler() from ~WebFrame()
+        https://bugs.webkit.org/show_bug.cgi?id=189199
+        <rdar://problem/42657233>
+
+        Reviewed by Youenn Fablet.
+
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::dispatchWillSubmitForm):
+        * WebCoreSupport/WebFrameLoaderClient.h:
+
 2018-08-31  Frederic Wang  <[email protected]>
 
         Bug 182053 - [CSSOM View] Implement standard behavior for scrollingElement

Modified: trunk/Source/WebKitLegacy/win/WebCoreSupport/WebFrameLoaderClient.cpp (235561 => 235562)


--- trunk/Source/WebKitLegacy/win/WebCoreSupport/WebFrameLoaderClient.cpp	2018-08-31 18:07:46 UTC (rev 235561)
+++ trunk/Source/WebKitLegacy/win/WebCoreSupport/WebFrameLoaderClient.cpp	2018-08-31 19:00:23 UTC (rev 235562)
@@ -599,7 +599,7 @@
 {
 }
 
-void WebFrameLoaderClient::dispatchWillSubmitForm(FormState& formState, WTF::Function<void(void)>&& function)
+void WebFrameLoaderClient::dispatchWillSubmitForm(FormState& formState, CompletionHandler<void()>&& completionHandler)
 {
     WebView* webView = m_webFrame->webView();
     Frame* coreFrame = core(m_webFrame);
@@ -608,7 +608,7 @@
     COMPtr<IWebFormDelegate> formDelegate;
 
     if (FAILED(webView->formDelegate(&formDelegate))) {
-        function();
+        completionHandler();
         return;
     }
 
@@ -623,11 +623,11 @@
     COMPtr<IPropertyBag> formValuesPropertyBag(AdoptCOM, COMPropertyBag<String>::createInstance(formValuesMap));
 
     COMPtr<WebFrame> sourceFrame(kit(formState.sourceDocument().frame()));
-    if (SUCCEEDED(formDelegate->willSubmitForm(m_webFrame, sourceFrame.get(), formElement.get(), formValuesPropertyBag.get(), setUpPolicyListener([function = WTFMove(function)] (PolicyAction) { function(); }).get())))
+    if (SUCCEEDED(formDelegate->willSubmitForm(m_webFrame, sourceFrame.get(), formElement.get(), formValuesPropertyBag.get(), setUpPolicyListener([completionHandler = WTFMove(completionHandler)] (PolicyAction) { completionHandler(); }).get())))
         return;
 
     // FIXME: Add a sane default implementation
-    function();
+    completionHandler();
 }
 
 void WebFrameLoaderClient::setMainDocumentError(DocumentLoader*, const ResourceError& error)

Modified: trunk/Source/WebKitLegacy/win/WebCoreSupport/WebFrameLoaderClient.h (235561 => 235562)


--- trunk/Source/WebKitLegacy/win/WebCoreSupport/WebFrameLoaderClient.h	2018-08-31 18:07:46 UTC (rev 235561)
+++ trunk/Source/WebKitLegacy/win/WebCoreSupport/WebFrameLoaderClient.h	2018-08-31 19:00:23 UTC (rev 235562)
@@ -108,7 +108,7 @@
     void dispatchUnableToImplementPolicy(const WebCore::ResourceError&) override;
 
     void dispatchWillSendSubmitEvent(Ref<WebCore::FormState>&&) override;
-    void dispatchWillSubmitForm(WebCore::FormState&, WTF::Function<void(void)>&&) override;
+    void dispatchWillSubmitForm(WebCore::FormState&, CompletionHandler<void()>&&) override;
 
     void revertToProvisionalState(WebCore::DocumentLoader*) override;
     bool dispatchDidLoadResourceFromMemoryCache(WebCore::DocumentLoader*, const WebCore::ResourceRequest&, const WebCore::ResourceResponse&, int length) override;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to