Title: [145622] branches/safari-536.30-branch
- Revision
- 145622
- Author
- [email protected]
- Date
- 2013-03-12 17:03:23 -0700 (Tue, 12 Mar 2013)
Log Message
Merged r135303. <rdar://problem/13334898>
Modified Paths
Added Paths
Diff
Modified: branches/safari-536.30-branch/LayoutTests/ChangeLog (145621 => 145622)
--- branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-13 00:02:54 UTC (rev 145621)
+++ branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-13 00:03:23 UTC (rev 145622)
@@ -1,5 +1,19 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r135303
+
+ 2012-11-20 Abhishek Arya <[email protected]>
+
+ Crash in FrameLoader::stopLoading.
+ https://bugs.webkit.org/show_bug.cgi?id=99504
+
+ Reviewed by Nate Chapin.
+
+ * fast/frames/frame-unload-crash2-expected.txt: Added.
+ * fast/frames/frame-unload-crash2.html: Added.
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r135299
2012-11-20 Tom Sepez <[email protected]>
Copied: branches/safari-536.30-branch/LayoutTests/fast/frames/frame-unload-crash2-expected.txt (from rev 135303, trunk/LayoutTests/fast/frames/frame-unload-crash2-expected.txt) (0 => 145622)
--- branches/safari-536.30-branch/LayoutTests/fast/frames/frame-unload-crash2-expected.txt (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/frames/frame-unload-crash2-expected.txt 2013-03-13 00:03:23 UTC (rev 145622)
@@ -0,0 +1 @@
+PASS. WebKit didn't crash.
Copied: branches/safari-536.30-branch/LayoutTests/fast/frames/frame-unload-crash2.html (from rev 135303, trunk/LayoutTests/fast/frames/frame-unload-crash2.html) (0 => 145622)
--- branches/safari-536.30-branch/LayoutTests/fast/frames/frame-unload-crash2.html (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/frames/frame-unload-crash2.html 2013-03-13 00:03:23 UTC (rev 145622)
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<iframe srcdoc=""></iframe>
+<script>
+if (window.testRunner) {
+ testRunner.waitUntilDone();
+ testRunner.dumpAsText();
+}
+
+function finish() {
+ if (window.testRunner)
+ testRunner.notifyDone();
+}
+
+frames[0]._onunload_ = function () {
+ document.open();
+ document.write("PASS. WebKit didn't crash.");
+ document.close();
+
+ setTimeout("finish()", 0);
+};
+</script>
+</html>
Modified: branches/safari-536.30-branch/Source/WebCore/ChangeLog (145621 => 145622)
--- branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-03-13 00:02:54 UTC (rev 145621)
+++ branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-03-13 00:03:23 UTC (rev 145622)
@@ -1,5 +1,24 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r135303
+
+ 2012-11-20 Abhishek Arya <[email protected]>
+
+ Crash in FrameLoader::stopLoading.
+ https://bugs.webkit.org/show_bug.cgi?id=99504
+
+ Reviewed by Nate Chapin.
+
+ Frame can be blown away in unload event handler. Need
+ to protect it with a RefPtr.
+
+ Test: fast/frames/frame-unload-crash2.html
+
+ * loader/FrameLoader.cpp:
+ (WebCore::FrameLoader::commitProvisionalLoad):
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r135299
2012-11-20 Tom Sepez <[email protected]>
Modified: branches/safari-536.30-branch/Source/WebCore/loader/FrameLoader.cpp (145621 => 145622)
--- branches/safari-536.30-branch/Source/WebCore/loader/FrameLoader.cpp 2013-03-13 00:02:54 UTC (rev 145621)
+++ branches/safari-536.30-branch/Source/WebCore/loader/FrameLoader.cpp 2013-03-13 00:03:23 UTC (rev 145622)
@@ -1628,6 +1628,7 @@
{
RefPtr<CachedPage> cachedPage = m_loadingFromCachedPage ? pageCache()->get(history()->provisionalItem()) : 0;
RefPtr<DocumentLoader> pdl = m_provisionalDocumentLoader;
+ RefPtr<Frame> protect(m_frame);
LOG(PageCache, "WebCoreLoading %s: About to commit provisional load from previous URL '%s' to new URL '%s'", m_frame->tree()->uniqueName().string().utf8().data(),
m_frame->document() ? m_frame->document()->url().string().utf8().data() : "",
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
