- Revision
- 185542
- Author
- [email protected]
- Date
- 2015-06-13 21:53:14 -0700 (Sat, 13 Jun 2015)
Log Message
[WK2] API::Navigation objects are leaked on history navigation to HistoryItems in PageCache
https://bugs.webkit.org/show_bug.cgi?id=145948
Reviewed by Darin Adler.
Source/WebCore:
API::Navigation objects were leaked on history navigation to
HistoryItems in PageCache. In such case, we would create 2 Navigation
objects instead of 1 and the first one would be leaked. The reason
we create the second one is because we fail to pass along the
navigationID from the UIProcess to the WebProcess and then back to the
UIProcess. On the IPC back to the UIProcess, the navigationID ends up
being 0 so the UIProcess creates a new Navigation object, thinking that
the load was triggered by the WebContent process.
We now pass along the navigationID, even if the HistoryItem is in the
PageCache and we end up reusing the cached DocumentLoader, instead of
creating a new one. A new updateCachedDocumentLoader() delegate is
added to the FrameLoaderClient, similarly to the pre-existing
createDocumentLoader() but for the case where the DocumentLoader gets
reused.
* loader/EmptyClients.h:
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::loadDifferentDocumentItem):
* loader/FrameLoaderClient.h:
Source/WebKit/mac:
Add empty implementation for new
FrameLoaderClient::updatedCachedDocumentLoader().
* WebCoreSupport/WebFrameLoaderClient.h:
Source/WebKit/win:
Add empty implementation for new
FrameLoaderClient::updatedCachedDocumentLoader().
* WebCoreSupport/WebFrameLoaderClient.h:
Source/WebKit2:
API::Navigation objects were leaked on history navigation to
HistoryItems in PageCache. In such case, we would create 2 Navigation
objects instead of 1 and the first one would be leaked. The reason
we create the second one is because we fail to pass along the
navigationID from the UIProcess to the WebProcess and then back to the
UIProcess. On the IPC back to the UIProcess, the navigationID ends up
being 0 so the UIProcess creates a new Navigation object, thinking that
the load was triggered by the WebContent process.
We now pass along the navigationID, even if the HistoryItem is in the
PageCache and we end up reusing the cached DocumentLoader, instead of
creating a new one. A new updateCachedDocumentLoader() delegate is
added to the FrameLoaderClient, similarly to the pre-existing
createDocumentLoader() but for the case where the DocumentLoader gets
reused.
* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
(WebKit::WebFrameLoaderClient::updateCachedDocumentLoader):
* WebProcess/WebCoreSupport/WebFrameLoaderClient.h:
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::goForward):
(WebKit::WebPage::goBack):
(WebKit::WebPage::goToBackForwardItem):
(WebKit::WebPage::updateCachedDocumentLoader):
* WebProcess/WebPage/WebPage.h:
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (185541 => 185542)
--- trunk/Source/WebCore/ChangeLog 2015-06-14 00:24:43 UTC (rev 185541)
+++ trunk/Source/WebCore/ChangeLog 2015-06-14 04:53:14 UTC (rev 185542)
@@ -1,3 +1,31 @@
+2015-06-13 Chris Dumez <[email protected]>
+
+ [WK2] API::Navigation objects are leaked on history navigation to HistoryItems in PageCache
+ https://bugs.webkit.org/show_bug.cgi?id=145948
+
+ Reviewed by Darin Adler.
+
+ API::Navigation objects were leaked on history navigation to
+ HistoryItems in PageCache. In such case, we would create 2 Navigation
+ objects instead of 1 and the first one would be leaked. The reason
+ we create the second one is because we fail to pass along the
+ navigationID from the UIProcess to the WebProcess and then back to the
+ UIProcess. On the IPC back to the UIProcess, the navigationID ends up
+ being 0 so the UIProcess creates a new Navigation object, thinking that
+ the load was triggered by the WebContent process.
+
+ We now pass along the navigationID, even if the HistoryItem is in the
+ PageCache and we end up reusing the cached DocumentLoader, instead of
+ creating a new one. A new updateCachedDocumentLoader() delegate is
+ added to the FrameLoaderClient, similarly to the pre-existing
+ createDocumentLoader() but for the case where the DocumentLoader gets
+ reused.
+
+ * loader/EmptyClients.h:
+ * loader/FrameLoader.cpp:
+ (WebCore::FrameLoader::loadDifferentDocumentItem):
+ * loader/FrameLoaderClient.h:
+
2015-06-13 Xabier Rodriguez Calvar <[email protected]> and Youenn Fablet <[email protected]>
[Streams API] ReadableJSStream should handle promises returned by JS source start callback
Modified: trunk/Source/WebCore/loader/EmptyClients.h (185541 => 185542)
--- trunk/Source/WebCore/loader/EmptyClients.h 2015-06-14 00:24:43 UTC (rev 185541)
+++ trunk/Source/WebCore/loader/EmptyClients.h 2015-06-14 04:53:14 UTC (rev 185542)
@@ -347,6 +347,7 @@
virtual void prepareForDataSourceReplacement() override { }
virtual PassRefPtr<DocumentLoader> createDocumentLoader(const ResourceRequest&, const SubstituteData&) override;
+ virtual void updateCachedDocumentLoader(DocumentLoader&) override { }
virtual void setTitle(const StringWithDirection&, const URL&) override { }
virtual String userAgent(const URL&) override { return ""; }
Modified: trunk/Source/WebCore/loader/FrameLoader.cpp (185541 => 185542)
--- trunk/Source/WebCore/loader/FrameLoader.cpp 2015-06-14 00:24:43 UTC (rev 185541)
+++ trunk/Source/WebCore/loader/FrameLoader.cpp 2015-06-14 04:53:14 UTC (rev 185542)
@@ -3177,6 +3177,7 @@
if (CachedPage* cachedPage = PageCache::singleton().get(item, m_frame.page())) {
auto documentLoader = cachedPage->documentLoader();
+ m_client.updateCachedDocumentLoader(*documentLoader);
documentLoader->setTriggeringAction(NavigationAction(documentLoader->request(), loadType, false));
documentLoader->setLastCheckedRequest(ResourceRequest());
loadWithDocumentLoader(documentLoader, loadType, 0, AllowNavigationToInvalidURL::Yes);
Modified: trunk/Source/WebCore/loader/FrameLoaderClient.h (185541 => 185542)
--- trunk/Source/WebCore/loader/FrameLoaderClient.h 2015-06-14 00:24:43 UTC (rev 185541)
+++ trunk/Source/WebCore/loader/FrameLoaderClient.h 2015-06-14 04:53:14 UTC (rev 185542)
@@ -251,6 +251,7 @@
virtual void prepareForDataSourceReplacement() = 0;
virtual PassRefPtr<DocumentLoader> createDocumentLoader(const ResourceRequest&, const SubstituteData&) = 0;
+ virtual void updateCachedDocumentLoader(DocumentLoader&) = 0;
virtual void setTitle(const StringWithDirection&, const URL&) = 0;
virtual String userAgent(const URL&) = 0;
Modified: trunk/Source/WebKit/mac/ChangeLog (185541 => 185542)
--- trunk/Source/WebKit/mac/ChangeLog 2015-06-14 00:24:43 UTC (rev 185541)
+++ trunk/Source/WebKit/mac/ChangeLog 2015-06-14 04:53:14 UTC (rev 185542)
@@ -1,3 +1,15 @@
+2015-06-13 Chris Dumez <[email protected]>
+
+ [WK2] API::Navigation objects are leaked on history navigation to HistoryItems in PageCache
+ https://bugs.webkit.org/show_bug.cgi?id=145948
+
+ Reviewed by Darin Adler.
+
+ Add empty implementation for new
+ FrameLoaderClient::updatedCachedDocumentLoader().
+
+ * WebCoreSupport/WebFrameLoaderClient.h:
+
2015-06-11 Mark Lam <[email protected]>
WebCore::reportException() needs to be able to accept a raw thrown value in addition to Exception objects.
Modified: trunk/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h (185541 => 185542)
--- trunk/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h 2015-06-14 00:24:43 UTC (rev 185541)
+++ trunk/Source/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h 2015-06-14 04:53:14 UTC (rev 185542)
@@ -193,6 +193,7 @@
virtual void didFinishLoad() override;
virtual void prepareForDataSourceReplacement() override;
virtual PassRefPtr<WebCore::DocumentLoader> createDocumentLoader(const WebCore::ResourceRequest&, const WebCore::SubstituteData&) override;
+ virtual void updateCachedDocumentLoader(WebCore::DocumentLoader&) override { }
virtual void setTitle(const WebCore::StringWithDirection&, const WebCore::URL&) override;
Modified: trunk/Source/WebKit/win/ChangeLog (185541 => 185542)
--- trunk/Source/WebKit/win/ChangeLog 2015-06-14 00:24:43 UTC (rev 185541)
+++ trunk/Source/WebKit/win/ChangeLog 2015-06-14 04:53:14 UTC (rev 185542)
@@ -1,3 +1,15 @@
+2015-06-13 Chris Dumez <[email protected]>
+
+ [WK2] API::Navigation objects are leaked on history navigation to HistoryItems in PageCache
+ https://bugs.webkit.org/show_bug.cgi?id=145948
+
+ Reviewed by Darin Adler.
+
+ Add empty implementation for new
+ FrameLoaderClient::updatedCachedDocumentLoader().
+
+ * WebCoreSupport/WebFrameLoaderClient.h:
+
2015-06-11 Mark Lam <[email protected]>
WebCore::reportException() needs to be able to accept a raw thrown value in addition to Exception objects.
Modified: trunk/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h (185541 => 185542)
--- trunk/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h 2015-06-14 00:24:43 UTC (rev 185541)
+++ trunk/Source/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h 2015-06-14 04:53:14 UTC (rev 185542)
@@ -152,6 +152,8 @@
virtual WTF::String userAgent(const WebCore::URL&) override;
virtual PassRefPtr<WebCore::DocumentLoader> createDocumentLoader(const WebCore::ResourceRequest&, const WebCore::SubstituteData&);
+ virtual void updateCachedDocumentLoader(WebCore::DocumentLoader&) override { }
+
virtual void setTitle(const WebCore::StringWithDirection&, const WebCore::URL&);
virtual void savePlatformDataToCachedFrame(WebCore::CachedFrame*) override;
Modified: trunk/Source/WebKit2/ChangeLog (185541 => 185542)
--- trunk/Source/WebKit2/ChangeLog 2015-06-14 00:24:43 UTC (rev 185541)
+++ trunk/Source/WebKit2/ChangeLog 2015-06-14 04:53:14 UTC (rev 185542)
@@ -1,3 +1,36 @@
+2015-06-13 Chris Dumez <[email protected]>
+
+ [WK2] API::Navigation objects are leaked on history navigation to HistoryItems in PageCache
+ https://bugs.webkit.org/show_bug.cgi?id=145948
+
+ Reviewed by Darin Adler.
+
+ API::Navigation objects were leaked on history navigation to
+ HistoryItems in PageCache. In such case, we would create 2 Navigation
+ objects instead of 1 and the first one would be leaked. The reason
+ we create the second one is because we fail to pass along the
+ navigationID from the UIProcess to the WebProcess and then back to the
+ UIProcess. On the IPC back to the UIProcess, the navigationID ends up
+ being 0 so the UIProcess creates a new Navigation object, thinking that
+ the load was triggered by the WebContent process.
+
+ We now pass along the navigationID, even if the HistoryItem is in the
+ PageCache and we end up reusing the cached DocumentLoader, instead of
+ creating a new one. A new updateCachedDocumentLoader() delegate is
+ added to the FrameLoaderClient, similarly to the pre-existing
+ createDocumentLoader() but for the case where the DocumentLoader gets
+ reused.
+
+ * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+ (WebKit::WebFrameLoaderClient::updateCachedDocumentLoader):
+ * WebProcess/WebCoreSupport/WebFrameLoaderClient.h:
+ * WebProcess/WebPage/WebPage.cpp:
+ (WebKit::WebPage::goForward):
+ (WebKit::WebPage::goBack):
+ (WebKit::WebPage::goToBackForwardItem):
+ (WebKit::WebPage::updateCachedDocumentLoader):
+ * WebProcess/WebPage/WebPage.h:
+
2015-06-12 Gavin Barraclough <[email protected]>
Add private API to force page to always run at foreground priority
Modified: trunk/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp (185541 => 185542)
--- trunk/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp 2015-06-14 00:24:43 UTC (rev 185541)
+++ trunk/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp 2015-06-14 04:53:14 UTC (rev 185542)
@@ -1246,6 +1246,11 @@
return m_frame->page()->createDocumentLoader(*m_frame->coreFrame(), request, substituteData);
}
+void WebFrameLoaderClient::updateCachedDocumentLoader(WebCore::DocumentLoader& loader)
+{
+ m_frame->page()->updateCachedDocumentLoader(static_cast<WebDocumentLoader&>(loader), *m_frame->coreFrame());
+}
+
void WebFrameLoaderClient::setTitle(const StringWithDirection& title, const URL& url)
{
WebPage* webPage = m_frame->page();
Modified: trunk/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.h (185541 => 185542)
--- trunk/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.h 2015-06-14 00:24:43 UTC (rev 185541)
+++ trunk/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.h 2015-06-14 04:53:14 UTC (rev 185542)
@@ -164,6 +164,8 @@
virtual void prepareForDataSourceReplacement() override;
virtual PassRefPtr<WebCore::DocumentLoader> createDocumentLoader(const WebCore::ResourceRequest&, const WebCore::SubstituteData&) override;
+ virtual void updateCachedDocumentLoader(WebCore::DocumentLoader&) override;
+
virtual void setTitle(const WebCore::StringWithDirection&, const WebCore::URL&) override;
virtual String userAgent(const WebCore::URL&) override;
Modified: trunk/Source/WebKit2/WebProcess/WebPage/WebPage.cpp (185541 => 185542)
--- trunk/Source/WebKit2/WebProcess/WebPage/WebPage.cpp 2015-06-14 00:24:43 UTC (rev 185541)
+++ trunk/Source/WebKit2/WebProcess/WebPage/WebPage.cpp 2015-06-14 04:53:14 UTC (rev 185542)
@@ -1161,8 +1161,7 @@
return;
ASSERT(!m_pendingNavigationID);
- if (!item->isInPageCache())
- m_pendingNavigationID = navigationID;
+ m_pendingNavigationID = navigationID;
m_page->goToItem(*item, FrameLoadType::Forward);
}
@@ -1177,8 +1176,7 @@
return;
ASSERT(!m_pendingNavigationID);
- if (!item->isInPageCache())
- m_pendingNavigationID = navigationID;
+ m_pendingNavigationID = navigationID;
m_page->goToItem(*item, FrameLoadType::Back);
}
@@ -1193,8 +1191,7 @@
return;
ASSERT(!m_pendingNavigationID);
- if (!item->isInPageCache())
- m_pendingNavigationID = navigationID;
+ m_pendingNavigationID = navigationID;
m_page->goToItem(*item, FrameLoadType::IndexedBackForward);
}
@@ -4924,6 +4921,14 @@
return documentLoader.release();
}
+void WebPage::updateCachedDocumentLoader(WebDocumentLoader& documentLoader, Frame& frame)
+{
+ if (m_pendingNavigationID && frame.isMainFrame()) {
+ documentLoader.setNavigationID(m_pendingNavigationID);
+ m_pendingNavigationID = 0;
+ }
+}
+
void WebPage::getBytecodeProfile(uint64_t callbackID)
{
if (!JSDOMWindow::commonVM().m_perBytecodeProfiler) {
Modified: trunk/Source/WebKit2/WebProcess/WebPage/WebPage.h (185541 => 185542)
--- trunk/Source/WebKit2/WebProcess/WebPage/WebPage.h 2015-06-14 00:24:43 UTC (rev 185541)
+++ trunk/Source/WebKit2/WebProcess/WebPage/WebPage.h 2015-06-14 04:53:14 UTC (rev 185542)
@@ -153,6 +153,7 @@
class WebColorChooser;
class WebContextMenu;
class WebContextMenuItemData;
+class WebDocumentLoader;
class WebEvent;
class WebFrame;
class WebFullScreenManager;
@@ -871,6 +872,7 @@
void setScrollbarOverlayStyle(WTF::Optional<uint32_t /* WebCore::ScrollbarOverlayStyle */> scrollbarStyle);
PassRefPtr<WebCore::DocumentLoader> createDocumentLoader(WebCore::Frame&, const WebCore::ResourceRequest&, const WebCore::SubstituteData&);
+ void updateCachedDocumentLoader(WebDocumentLoader&, WebCore::Frame&);
void getBytecodeProfile(uint64_t callbackID);
