Title: [187666] branches/safari-601.1-branch/Source/WebCore

Diff

Modified: branches/safari-601.1-branch/Source/WebCore/ChangeLog (187665 => 187666)


--- branches/safari-601.1-branch/Source/WebCore/ChangeLog	2015-07-31 18:33:35 UTC (rev 187665)
+++ branches/safari-601.1-branch/Source/WebCore/ChangeLog	2015-07-31 18:38:11 UTC (rev 187666)
@@ -1,5 +1,25 @@
 2015-07-31  Lucas Forschler  <[email protected]>
 
+        Merge r187557
+
+    2015-07-29  Brady Eidson  <[email protected]>
+
+            Crash in WebCore::DocumentLoader::stopLoadingForPolicyChange.
+            <rdar://problem/21412186> and https://bugs.webkit.org/show_bug.cgi?id=147418
+
+            Reviewed by Chris Dumez.
+
+            No new tests (No known reproducibility)
+
+            * loader/DocumentLoader.cpp:
+            (WebCore::DocumentLoader::responseReceived): When setting to m_waitingForContentPolicy true, make sure we have a FrameLoader.
+            (WebCore::DocumentLoader::detachFromFrame): Always explicitly call cancelPolicyCheckIfNeeded().
+            (WebCore::DocumentLoader::cancelPolicyCheckIfNeeded): Cancel the policy check if there is one.
+            (WebCore::DocumentLoader::cancelMainResourceLoad): Use cancelPolicyCheckIfNeeded().
+            * loader/DocumentLoader.h:
+
+2015-07-31  Lucas Forschler  <[email protected]>
+
         Merge r187556
 
     2015-07-29  Brady Eidson  <[email protected]>

Modified: branches/safari-601.1-branch/Source/WebCore/loader/DocumentLoader.cpp (187665 => 187666)


--- branches/safari-601.1-branch/Source/WebCore/loader/DocumentLoader.cpp	2015-07-31 18:33:35 UTC (rev 187665)
+++ branches/safari-601.1-branch/Source/WebCore/loader/DocumentLoader.cpp	2015-07-31 18:38:11 UTC (rev 187666)
@@ -652,6 +652,7 @@
     }
 
     ASSERT(!m_waitingForContentPolicy);
+    ASSERT(frameLoader());
     m_waitingForContentPolicy = true;
 
     // Always show content with valid substitute data.
@@ -950,6 +951,8 @@
 
     m_applicationCacheHost->setDOMApplicationCache(nullptr);
 
+    cancelPolicyCheckIfNeeded();
+
     // Even though we ASSERT at the top of this method that we have an m_frame, we're seeing crashes where m_frame is null.
     // This means either that a DocumentLoader is detaching twice, or is detaching before ever having attached.
     // Until we figure out how that is happening, null check m_frame before dereferencing it here.
@@ -958,8 +961,6 @@
         InspectorInstrumentation::loaderDetachedFromFrame(*m_frame, *this);
 
     m_frame = nullptr;
-    // The call to stopLoading() above should have canceled any pending content policy check.
-    ASSERT_WITH_MESSAGE(!m_waitingForContentPolicy, "The content policy callback needs a valid frame.");
 }
 
 void DocumentLoader::clearMainResourceLoader()
@@ -1468,18 +1469,23 @@
     setRequest(request);
 }
 
+void DocumentLoader::cancelPolicyCheckIfNeeded()
+{
+    if (m_waitingForContentPolicy && frameLoader())
+        frameLoader()->policyChecker().cancelCheck();
+
+    m_waitingForContentPolicy = false;
+}
+
 void DocumentLoader::cancelMainResourceLoad(const ResourceError& resourceError)
 {
     Ref<DocumentLoader> protect(*this);
     ResourceError error = resourceError.isNull() ? frameLoader()->cancelledError(m_request) : resourceError;
 
     m_dataLoadTimer.stop();
-    if (m_waitingForContentPolicy) {
-        frameLoader()->policyChecker().cancelCheck();
-        ASSERT(m_waitingForContentPolicy);
-        m_waitingForContentPolicy = false;
-    }
 
+    cancelPolicyCheckIfNeeded();
+
     if (mainResourceLoader())
         mainResourceLoader()->cancel(error);
 

Modified: branches/safari-601.1-branch/Source/WebCore/loader/DocumentLoader.h (187665 => 187666)


--- branches/safari-601.1-branch/Source/WebCore/loader/DocumentLoader.h	2015-07-31 18:33:35 UTC (rev 187665)
+++ branches/safari-601.1-branch/Source/WebCore/loader/DocumentLoader.h	2015-07-31 18:38:11 UTC (rev 187666)
@@ -336,6 +336,8 @@
 
         void clearMainResource();
 
+        void cancelPolicyCheckIfNeeded();
+
 #if ENABLE(CONTENT_FILTERING)
         void becomeMainResourceClientIfFilterAllows();
         void installContentFilterUnblockHandler(ContentFilter&);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to