Title: [185403] trunk/Source/WebCore
- Revision
- 185403
- Author
- [email protected]
- Date
- 2015-06-09 22:59:54 -0700 (Tue, 09 Jun 2015)
Log Message
Protect FrameView from being destroyed in Document::recalcStyle()
https://bugs.webkit.org/show_bug.cgi?id=143033
rdar://problem/20326871
Reviewed by Andreas Kling.
This patch ensures that FrameView stays valid in Document::recalcStyle().
It follows the defensive pattern we use to deal with the refcounted FrameView (see EventDispatcher::dispatchEvent)
When the iframe destroys itself in the onBeforeLoad callback (as the result of
PostResolutionCallbackDisabler -> HTMLObjectElement::updateWidget -> guardedDispatchBeforeLoadEvent),
we detach the frame and release the FrameView. However Document::recalcStyle() expects
the FrameView to stay valid.
Covered by fast/frames/flattening/crash-remove-iframe-during-object-beforeload.html.
* dom/Document.cpp:
(WebCore::Document::recalcStyle):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (185402 => 185403)
--- trunk/Source/WebCore/ChangeLog 2015-06-10 05:38:03 UTC (rev 185402)
+++ trunk/Source/WebCore/ChangeLog 2015-06-10 05:59:54 UTC (rev 185403)
@@ -1,3 +1,24 @@
+2015-06-09 Zalan Bujtas <[email protected]>
+
+ Protect FrameView from being destroyed in Document::recalcStyle()
+ https://bugs.webkit.org/show_bug.cgi?id=143033
+ rdar://problem/20326871
+
+ Reviewed by Andreas Kling.
+
+ This patch ensures that FrameView stays valid in Document::recalcStyle().
+ It follows the defensive pattern we use to deal with the refcounted FrameView (see EventDispatcher::dispatchEvent)
+
+ When the iframe destroys itself in the onBeforeLoad callback (as the result of
+ PostResolutionCallbackDisabler -> HTMLObjectElement::updateWidget -> guardedDispatchBeforeLoadEvent),
+ we detach the frame and release the FrameView. However Document::recalcStyle() expects
+ the FrameView to stay valid.
+
+ Covered by fast/frames/flattening/crash-remove-iframe-during-object-beforeload.html.
+
+ * dom/Document.cpp:
+ (WebCore::Document::recalcStyle):
+
2015-06-09 Daegyu Lee <[email protected]>
3D-transformed video does not display on platforms without accelerated video rendering
Modified: trunk/Source/WebCore/dom/Document.cpp (185402 => 185403)
--- trunk/Source/WebCore/dom/Document.cpp 2015-06-10 05:38:03 UTC (rev 185402)
+++ trunk/Source/WebCore/dom/Document.cpp 2015-06-10 05:59:54 UTC (rev 185403)
@@ -1738,6 +1738,7 @@
return;
FrameView& frameView = m_renderView->frameView();
+ Ref<FrameView> protect(frameView);
if (frameView.isPainting())
return;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
