Diff
Modified: trunk/Source/WebCore/ChangeLog (149588 => 149589)
--- trunk/Source/WebCore/ChangeLog 2013-05-06 09:46:58 UTC (rev 149588)
+++ trunk/Source/WebCore/ChangeLog 2013-05-06 10:29:44 UTC (rev 149589)
@@ -1,3 +1,23 @@
+2013-05-04 Andy Estes <[email protected]>
+
+ REGRESSION (r125592): Reproducible crash in DOMWindow::open when a delegate closes the new window in decidePolicyForNavigationAction
+ https://bugs.webkit.org/show_bug.cgi?id=115609
+
+ Reviewed by Oliver Hunt.
+
+ When a window created by window.open() is navigated, the embedder might
+ close it in decidePolicyForNavigationAction. If this happens, we end up
+ with a pointer to a deleted Frame.
+
+ Fix this by keeping a strong reference to the Frame created by
+ createWindow(). We can later determine if the window was closed by
+ checking if the new Frame has a detached Page.
+
+ Added an API test: WebKit1.CloseNewWindowInNavigationPolicyDelegate.
+
+ * page/DOMWindow.cpp:
+ (WebCore::DOMWindow::createWindow):
+
2013-05-06 Zan Dobersek <[email protected]>
[GTK] Move GeolocationProviderGeoclue into libPlatform
Modified: trunk/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp (149588 => 149589)
--- trunk/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp 2013-05-06 09:46:58 UTC (rev 149588)
+++ trunk/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp 2013-05-06 10:29:44 UTC (rev 149589)
@@ -215,7 +215,7 @@
bool created;
WindowFeatures windowFeatures;
- Frame* frame = WebCore::createWindow(mainFrame, mainFrame, request, windowFeatures, created);
+ RefPtr<Frame> frame = WebCore::createWindow(mainFrame, mainFrame, request, windowFeatures, created);
if (!frame)
return;
Modified: trunk/Source/WebCore/loader/FrameLoader.cpp (149588 => 149589)
--- trunk/Source/WebCore/loader/FrameLoader.cpp 2013-05-06 09:46:58 UTC (rev 149588)
+++ trunk/Source/WebCore/loader/FrameLoader.cpp 2013-05-06 10:29:44 UTC (rev 149589)
@@ -3329,7 +3329,7 @@
return true;
}
-Frame* createWindow(Frame* openerFrame, Frame* lookupFrame, const FrameLoadRequest& request, const WindowFeatures& features, bool& created)
+PassRefPtr<Frame> createWindow(Frame* openerFrame, Frame* lookupFrame, const FrameLoadRequest& request, const WindowFeatures& features, bool& created)
{
ASSERT(!features.dialog || request.frameName().isEmpty());
Modified: trunk/Source/WebCore/loader/FrameLoader.h (149588 => 149589)
--- trunk/Source/WebCore/loader/FrameLoader.h 2013-05-06 09:46:58 UTC (rev 149588)
+++ trunk/Source/WebCore/loader/FrameLoader.h 2013-05-06 10:29:44 UTC (rev 149589)
@@ -452,7 +452,7 @@
//
// FIXME: Consider making this function part of an appropriate class (not FrameLoader)
// and moving it to a more appropriate location.
-Frame* createWindow(Frame* openerFrame, Frame* lookupFrame, const FrameLoadRequest&, const WindowFeatures&, bool& created);
+PassRefPtr<Frame> createWindow(Frame* openerFrame, Frame* lookupFrame, const FrameLoadRequest&, const WindowFeatures&, bool& created);
} // namespace WebCore
Modified: trunk/Source/WebCore/page/DOMWindow.cpp (149588 => 149589)
--- trunk/Source/WebCore/page/DOMWindow.cpp 2013-05-06 09:46:58 UTC (rev 149588)
+++ trunk/Source/WebCore/page/DOMWindow.cpp 2013-05-06 10:29:44 UTC (rev 149589)
@@ -1885,7 +1885,7 @@
return true;
}
-Frame* DOMWindow::createWindow(const String& urlString, const AtomicString& frameName, const WindowFeatures& windowFeatures,
+PassRefPtr<Frame> DOMWindow::createWindow(const String& urlString, const AtomicString& frameName, const WindowFeatures& windowFeatures,
DOMWindow* activeWindow, Frame* firstFrame, Frame* openerFrame, PrepareDialogFunction function, void* functionContext)
{
Frame* activeFrame = activeWindow->frame();
@@ -1907,7 +1907,7 @@
// We pass the opener frame for the lookupFrame in case the active frame is different from
// the opener frame, and the name references a frame relative to the opener frame.
bool created;
- Frame* newFrame = WebCore::createWindow(activeFrame, openerFrame, frameRequest, windowFeatures, created);
+ RefPtr<Frame> newFrame = WebCore::createWindow(activeFrame, openerFrame, frameRequest, windowFeatures, created);
if (!newFrame)
return 0;
@@ -1915,7 +1915,7 @@
newFrame->page()->setOpenedByDOM();
if (newFrame->document()->domWindow()->isInsecureScriptAccess(activeWindow, completedURL))
- return newFrame;
+ return newFrame.release();
if (function)
function(newFrame->document()->domWindow(), functionContext);
@@ -1927,7 +1927,11 @@
newFrame->navigationScheduler()->scheduleLocationChange(activeWindow->document()->securityOrigin(), completedURL.string(), referrer, lockHistory, false);
}
- return newFrame;
+ // Navigating the new frame could result in it being detached from its page by a navigation policy delegate.
+ if (!newFrame->page())
+ return 0;
+
+ return newFrame.release();
}
PassRefPtr<DOMWindow> DOMWindow::open(const String& urlString, const AtomicString& frameName, const String& windowFeaturesString,
@@ -1985,7 +1989,7 @@
}
WindowFeatures windowFeatures(windowFeaturesString);
- Frame* result = createWindow(urlString, frameName, windowFeatures, activeWindow, firstFrame, m_frame);
+ RefPtr<Frame> result = createWindow(urlString, frameName, windowFeatures, activeWindow, firstFrame, m_frame);
return result ? result->document()->domWindow() : 0;
}
@@ -2005,7 +2009,7 @@
return;
WindowFeatures windowFeatures(dialogFeaturesString, screenAvailableRect(m_frame->view()));
- Frame* dialogFrame = createWindow(urlString, emptyAtom, windowFeatures,
+ RefPtr<Frame> dialogFrame = createWindow(urlString, emptyAtom, windowFeatures,
activeWindow, firstFrame, m_frame, function, functionContext);
if (!dialogFrame)
return;
Modified: trunk/Source/WebCore/page/DOMWindow.h (149588 => 149589)
--- trunk/Source/WebCore/page/DOMWindow.h 2013-05-06 09:46:58 UTC (rev 149588)
+++ trunk/Source/WebCore/page/DOMWindow.h 2013-05-06 10:29:44 UTC (rev 149589)
@@ -426,7 +426,7 @@
virtual EventTargetData* eventTargetData();
virtual EventTargetData* ensureEventTargetData();
- static Frame* createWindow(const String& urlString, const AtomicString& frameName, const WindowFeatures&,
+ static PassRefPtr<Frame> createWindow(const String& urlString, const AtomicString& frameName, const WindowFeatures&,
DOMWindow* activeWindow, Frame* firstFrame, Frame* openerFrame,
PrepareDialogFunction = 0, void* functionContext = 0);
bool isInsecureScriptAccess(DOMWindow* activeWindow, const String& urlString);
Modified: trunk/Tools/ChangeLog (149588 => 149589)
--- trunk/Tools/ChangeLog 2013-05-06 09:46:58 UTC (rev 149588)
+++ trunk/Tools/ChangeLog 2013-05-06 10:29:44 UTC (rev 149589)
@@ -1,3 +1,21 @@
+2013-05-04 Andy Estes <[email protected]>
+
+ REGRESSION (r125592): Reproducible crash in DOMWindow::open when a delegate closes the new window in decidePolicyForNavigationAction
+ https://bugs.webkit.org/show_bug.cgi?id=115609
+
+ Reviewed by Oliver Hunt.
+
+ Added an API test.
+
+ * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+ * TestWebKitAPI/Tests/mac/CloseNewWindowInNavigationPolicyDelegate.mm: Added.
+ (+[TestDelegate shared]):
+ (-[TestDelegate webView:decidePolicyForNavigationAction:request:frame:decisionListener:]):
+ (-[TestDelegate webView:createWebViewWithRequest:]):
+ (TestWebKitAPI):
+ (TestWebKitAPI::TEST):
+ * TestWebKitAPI/Tests/mac/OpenNewWindow.html: Added.
+
2013-05-06 Antoine Quint <[email protected]>
Manage the presentation of the snapshotted plug-in using _javascript_
Modified: trunk/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj (149588 => 149589)
--- trunk/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj 2013-05-06 09:46:58 UTC (rev 149588)
+++ trunk/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj 2013-05-06 10:29:44 UTC (rev 149589)
@@ -35,6 +35,8 @@
26DF5A6315A2A27E003689C2 /* CancelLoadFromResourceLoadDelegate.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 26DF5A6115A2A22B003689C2 /* CancelLoadFromResourceLoadDelegate.html */; };
26F1B44415CA434F00D1E4BF /* AtomicString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 26F1B44215CA434F00D1E4BF /* AtomicString.cpp */; };
26F1B44515CA434F00D1E4BF /* StringImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 26F1B44315CA434F00D1E4BF /* StringImpl.cpp */; };
+ 290A9BB71735DE8A00D71BBC /* CloseNewWindowInNavigationPolicyDelegate.mm in Sources */ = {isa = PBXBuildFile; fileRef = 290A9BB51735DE8A00D71BBC /* CloseNewWindowInNavigationPolicyDelegate.mm */; };
+ 290A9BB91735F63800D71BBC /* OpenNewWindow.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 290A9BB81735F42300D71BBC /* OpenNewWindow.html */; };
290F4275172A221C00939FF0 /* custom-protocol-sync-xhr.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 290F4274172A1FDE00939FF0 /* custom-protocol-sync-xhr.html */; };
290F4278172A232C00939FF0 /* CustomProtocolsSyncXHRTest.mm in Sources */ = {isa = PBXBuildFile; fileRef = 290F4276172A232C00939FF0 /* CustomProtocolsSyncXHRTest.mm */; };
290F427B172A23A500939FF0 /* TestProtocol.mm in Sources */ = {isa = PBXBuildFile; fileRef = 290F4279172A23A500939FF0 /* TestProtocol.mm */; };
@@ -236,6 +238,7 @@
dstPath = TestWebKitAPI.resources;
dstSubfolderSpec = 7;
files = (
+ 290A9BB91735F63800D71BBC /* OpenNewWindow.html in Copy Resources */,
290F4275172A221C00939FF0 /* custom-protocol-sync-xhr.html in Copy Resources */,
C2CF975B16CEC71B0054E99D /* JSContextBackForwardCache1.html in Copy Resources */,
C2CF975A16CEC7140054E99D /* JSContextBackForwardCache2.html in Copy Resources */,
@@ -307,6 +310,8 @@
26DF5A6115A2A22B003689C2 /* CancelLoadFromResourceLoadDelegate.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = CancelLoadFromResourceLoadDelegate.html; sourceTree = "<group>"; };
26F1B44215CA434F00D1E4BF /* AtomicString.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AtomicString.cpp; path = WTF/AtomicString.cpp; sourceTree = "<group>"; };
26F1B44315CA434F00D1E4BF /* StringImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = StringImpl.cpp; path = WTF/StringImpl.cpp; sourceTree = "<group>"; };
+ 290A9BB51735DE8A00D71BBC /* CloseNewWindowInNavigationPolicyDelegate.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = CloseNewWindowInNavigationPolicyDelegate.mm; sourceTree = "<group>"; };
+ 290A9BB81735F42300D71BBC /* OpenNewWindow.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = OpenNewWindow.html; sourceTree = "<group>"; };
290F4274172A1FDE00939FF0 /* custom-protocol-sync-xhr.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = "custom-protocol-sync-xhr.html"; sourceTree = "<group>"; };
290F4276172A232C00939FF0 /* CustomProtocolsSyncXHRTest.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = CustomProtocolsSyncXHRTest.mm; sourceTree = "<group>"; };
290F4279172A23A500939FF0 /* TestProtocol.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = TestProtocol.mm; sourceTree = "<group>"; };
@@ -822,6 +827,7 @@
B55F119F1516834F00915916 /* AttributedString.mm */,
00CD9F6215BE312C002DA2CE /* BackForwardList.mm */,
26DF5A5D15A29BAA003689C2 /* CancelLoadFromResourceLoadDelegate.mm */,
+ 290A9BB51735DE8A00D71BBC /* CloseNewWindowInNavigationPolicyDelegate.mm */,
5142B2701517C88B00C32B19 /* ContextMenuCanCopyURL.mm */,
3776BC62150946BC0043A66D /* DeviceScaleFactorInDashboardRegions.mm */,
939BA91614103412001A01BD /* DeviceScaleFactorOnBack.mm */,
@@ -871,6 +877,7 @@
9B26FCB4159D15E700CC3765 /* HTMLFormCollectionNamedItem.html */,
E1220DC9155B287D0013E2FC /* MemoryCacheDisableWithinResourceLoadDelegate.html */,
517E7E031511187500D0B008 /* MemoryCachePruneWithinResourceLoadDelegate.html */,
+ 290A9BB81735F42300D71BBC /* OpenNewWindow.html */,
A57A34F116AF69E200C2501F /* PageVisibilityStateWithWindowChanges.html */,
52B8CF9415868CF000281053 /* SetDocumentURI.html */,
C540F783152E5A7800A40C8C /* verboseMarkup.html */,
@@ -1118,6 +1125,7 @@
BC55F5F914AD78EE00484BE1 /* Vector.cpp in Sources */,
BC90964C125561BF00083756 /* VectorBasic.cpp in Sources */,
37200B9213A16230007A4FAD /* VectorReverse.cpp in Sources */,
+ 290A9BB71735DE8A00D71BBC /* CloseNewWindowInNavigationPolicyDelegate.mm in Sources */,
FE217ECD1640A54A0052988B /* VMInspector.cpp in Sources */,
520BCF4D141EB09E00937EA8 /* WebArchive.cpp in Sources */,
0F17BBD615AF6C4D007AB753 /* WebCoreStatisticsWithNoWebProcess.cpp in Sources */,
