[webkit-changes] [124827] branches/safari-536.26-branch

Mon, 06 Aug 2012 18:14:37 -0700

Title: [124827] branches/safari-536.26-branch

Diff

Modified: branches/safari-536.26-branch/LayoutTests/ChangeLog (124826 => 124827)


--- branches/safari-536.26-branch/LayoutTests/ChangeLog	2012-08-07 01:07:01 UTC (rev 124826)
+++ branches/safari-536.26-branch/LayoutTests/ChangeLog	2012-08-07 01:14:51 UTC (rev 124827)
@@ -1,3 +1,15 @@
+2012-08-06  Lucas Forschler  <lforsch...@apple.com>
+
+    Merge 120845
+
+    2012-06-20  Nate Chapin  <jap...@chromium.org>
+
+            Test for https://bugs.webkit.org/show_bug.cgi?id=89378.
+            Reviewed by Eric Seidel.
+
+            * http/tests/xmlhttprequest/reentrant-cancel-expected.txt: Added.
+            * http/tests/xmlhttprequest/reentrant-cancel.html: Added.
+
 2012-08-02  Lucas Forschler  <lforsch...@apple.com>
 
     Merge 121307

Copied: branches/safari-536.26-branch/LayoutTests/http/tests/xmlhttprequest/reentrant-cancel-expected.txt (from rev 120845, trunk/LayoutTests/http/tests/xmlhttprequest/reentrant-cancel-expected.txt) (0 => 124827)


--- branches/safari-536.26-branch/LayoutTests/http/tests/xmlhttprequest/reentrant-cancel-expected.txt	                        (rev 0)
+++ branches/safari-536.26-branch/LayoutTests/http/tests/xmlhttprequest/reentrant-cancel-expected.txt	2012-08-07 01:14:51 UTC (rev 124827)
@@ -0,0 +1 @@
+XThis tests that when we re-entrantly create and cancel XHRs, we don't try to disconnect the same CachedResourceClient multiple times from its CachedResource. We pass if we don't crash. XX

Copied: branches/safari-536.26-branch/LayoutTests/http/tests/xmlhttprequest/reentrant-cancel.html (from rev 120845, trunk/LayoutTests/http/tests/xmlhttprequest/reentrant-cancel.html) (0 => 124827)


--- branches/safari-536.26-branch/LayoutTests/http/tests/xmlhttprequest/reentrant-cancel.html	                        (rev 0)
+++ branches/safari-536.26-branch/LayoutTests/http/tests/xmlhttprequest/reentrant-cancel.html	2012-08-07 01:14:51 UTC (rev 124827)
@@ -0,0 +1,21 @@
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function addElement() {
+    document.documentElement.appendChild(document.createTextNode('X'));
+}
+document.addEventListener("DOMContentLoaded", addElement, false);
+window._onload_ = addElement;
+
+var xhr = new XMLHttpRequest;
+function sendXHR()
+{
+    xhr.open("GET", "", true);
+    xhr.send();
+}
+window.addEventListener("DOMSubtreeModified", sendXHR);
+addElement();
+</script>
+This tests that when we re-entrantly create and cancel XHRs, we don't try to disconnect the same CachedResourceClient
+multiple times from its CachedResource. We pass if we don't crash.

Modified: branches/safari-536.26-branch/Source/WebCore/ChangeLog (124826 => 124827)


--- branches/safari-536.26-branch/Source/WebCore/ChangeLog	2012-08-07 01:07:01 UTC (rev 124826)
+++ branches/safari-536.26-branch/Source/WebCore/ChangeLog	2012-08-07 01:14:51 UTC (rev 124827)
@@ -1,5 +1,24 @@
 2012-08-06  Lucas Forschler  <lforsch...@apple.com>
 
+    Merge 120845
+
+    2012-06-20  Nate Chapin  <jap...@chromium.org>
+
+            Don't re-enter CachedResource::removeClient() if an XHR
+            is canceled and restarted multiple times.
+            https://bugs.webkit.org/show_bug.cgi?id=89378
+
+            Reviewed by Eric Seidel.
+
+            Test: http/tests/xmlhttprequest/reentrant-cancel.html
+
+            * loader/DocumentThreadableLoader.cpp:
+            (WebCore::DocumentThreadableLoader::cancel):
+            (WebCore::DocumentThreadableLoader::clearResource): Save off a copy of m_resource
+               then clear it, so we don't call clearResource() multiple times for the same resource.
+
+2012-08-06  Lucas Forschler  <lforsch...@apple.com>
+
     Revert 116203
 
     2012-05-04  Julien Chaffraix  <jchaffr...@webkit.org>

Modified: branches/safari-536.26-branch/Source/WebCore/loader/DocumentThreadableLoader.cpp (124826 => 124827)


--- branches/safari-536.26-branch/Source/WebCore/loader/DocumentThreadableLoader.cpp	2012-08-07 01:07:01 UTC (rev 124826)
+++ branches/safari-536.26-branch/Source/WebCore/loader/DocumentThreadableLoader.cpp	2012-08-07 01:14:51 UTC (rev 124827)
@@ -146,7 +146,8 @@
 
 void DocumentThreadableLoader::cancel()
 {
-    if (m_client) {
+    // Cacnel can re-enter and m_resource might be null here as a result.
+    if (m_client && m_resource) {
         ResourceError error(errorDomainWebKitInternal, 0, m_resource->url(), "Load cancelled");
         error.setIsCancellation(true);
         didFail(error);
@@ -163,9 +164,13 @@
 
 void DocumentThreadableLoader::clearResource()
 {
-    if (m_resource) {
-        m_resource->removeClient(this);
+    // Script can cancel and restart a request reentrantly within removeClient(),
+    // which could lead to calling CachedResource::removeClient() multiple times for
+    // this DocumentThreadableLoader. Save off a copy of m_resource and clear it to
+    // prevent the reentrancy.
+    if (CachedResourceHandle<CachedRawResource> resource = m_resource) {
         m_resource = 0;
+        resource->removeClient(this);
     }
 }
 

_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to