Title: [179880] trunk/Source/WebCore
- Revision
- 179880
- Author
- [email protected]
- Date
- 2015-02-10 13:44:01 -0800 (Tue, 10 Feb 2015)
Log Message
Add assertion to help track down WebCore::DocumentLoader::stopLoadingForPolicyChange() crash
https://bugs.webkit.org/show_bug.cgi?id=141441
<rdar://problem/13811738>
Reviewed by Alexey Proskuryakov.
Add assertion to help track down a crash in
WebCore::DocumentLoader::stopLoadingForPolicyChange().
* loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::~DocumentLoader):
Make sure the DocumentLoader is not waiting for a content policy
response when it is destroyed. If this were to happen, then the
lambda function passed to PolicyChecker::checkContentPolicy()
would outlive the DocumentLoader. This is an issue because
that lambda function captures [this], which is the DocumentLoader.
This would cause DocumentLoader::continueAfterContentPolicy() to
be called after the DocumentLoader has been destroyed, which would
explain the crash.
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (179879 => 179880)
--- trunk/Source/WebCore/ChangeLog 2015-02-10 21:41:53 UTC (rev 179879)
+++ trunk/Source/WebCore/ChangeLog 2015-02-10 21:44:01 UTC (rev 179880)
@@ -1,3 +1,25 @@
+2015-02-10 Chris Dumez <[email protected]>
+
+ Add assertion to help track down WebCore::DocumentLoader::stopLoadingForPolicyChange() crash
+ https://bugs.webkit.org/show_bug.cgi?id=141441
+ <rdar://problem/13811738>
+
+ Reviewed by Alexey Proskuryakov.
+
+ Add assertion to help track down a crash in
+ WebCore::DocumentLoader::stopLoadingForPolicyChange().
+
+ * loader/DocumentLoader.cpp:
+ (WebCore::DocumentLoader::~DocumentLoader):
+ Make sure the DocumentLoader is not waiting for a content policy
+ response when it is destroyed. If this were to happen, then the
+ lambda function passed to PolicyChecker::checkContentPolicy()
+ would outlive the DocumentLoader. This is an issue because
+ that lambda function captures [this], which is the DocumentLoader.
+ This would cause DocumentLoader::continueAfterContentPolicy() to
+ be called after the DocumentLoader has been destroyed, which would
+ explain the crash.
+
2015-02-07 Zalan Bujtas <[email protected]>
REGRESSION (r168046): Crash in WebCore::InlineBox::renderer / WebCore::RenderFlowThread::checkLinesConsistency
Modified: trunk/Source/WebCore/loader/DocumentLoader.cpp (179879 => 179880)
--- trunk/Source/WebCore/loader/DocumentLoader.cpp 2015-02-10 21:41:53 UTC (rev 179879)
+++ trunk/Source/WebCore/loader/DocumentLoader.cpp 2015-02-10 21:44:01 UTC (rev 179880)
@@ -161,6 +161,7 @@
DocumentLoader::~DocumentLoader()
{
ASSERT(!m_frame || frameLoader()->activeDocumentLoader() != this || !isLoading());
+ ASSERT(!m_waitingForContentPolicy);
if (m_iconLoadDecisionCallback)
m_iconLoadDecisionCallback->invalidate();
if (m_iconDataCallback)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
