Title: [167790] trunk/Source/WebCore
- Revision
- 167790
- Author
- [email protected]
- Date
- 2014-04-24 23:01:34 -0700 (Thu, 24 Apr 2014)
Log Message
FrameLoader::checkCompleted can hit the "ref'ing while destroyed" assertion
https://bugs.webkit.org/show_bug.cgi?id=132163
rdar://problem/16720640
Reviewed by Brady Eidson.
Couldn't find a way to test this yet. Would be nice to have a test.
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::checkCompleted): Move protector until after we check
if the frame is already complete. That can happen in practice when this is
called from within the frame's destructor. All the code that runs before the
protector simply checks state and does not require protection.
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (167789 => 167790)
--- trunk/Source/WebCore/ChangeLog 2014-04-25 03:59:46 UTC (rev 167789)
+++ trunk/Source/WebCore/ChangeLog 2014-04-25 06:01:34 UTC (rev 167790)
@@ -1,3 +1,19 @@
+2014-04-24 Darin Adler <[email protected]>
+
+ FrameLoader::checkCompleted can hit the "ref'ing while destroyed" assertion
+ https://bugs.webkit.org/show_bug.cgi?id=132163
+ rdar://problem/16720640
+
+ Reviewed by Brady Eidson.
+
+ Couldn't find a way to test this yet. Would be nice to have a test.
+
+ * loader/FrameLoader.cpp:
+ (WebCore::FrameLoader::checkCompleted): Move protector until after we check
+ if the frame is already complete. That can happen in practice when this is
+ called from within the frame's destructor. All the code that runs before the
+ protector simply checks state and does not require protection.
+
2014-04-24 Gyuyoung Kim <[email protected]>
Mark Supplement instead of RefCountedSupplement in NavigatorContentUtils
Modified: trunk/Source/WebCore/loader/FrameLoader.cpp (167789 => 167790)
--- trunk/Source/WebCore/loader/FrameLoader.cpp 2014-04-25 03:59:46 UTC (rev 167789)
+++ trunk/Source/WebCore/loader/FrameLoader.cpp 2014-04-25 06:01:34 UTC (rev 167790)
@@ -793,7 +793,6 @@
void FrameLoader::checkCompleted()
{
- Ref<Frame> protect(m_frame);
m_shouldCallCheckCompleted = false;
// Have we completed before?
@@ -816,6 +815,11 @@
if (!allChildrenAreComplete())
return;
+ // Important not to protect earlier in this function, because earlier parts
+ // of this function can be called the frame's destructor, and it's not legal
+ // to ref an object while it's being destroyed.
+ Ref<Frame> protect(m_frame);
+
// OK, completed.
m_isComplete = true;
m_requestedHistoryItem = 0;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
