Title: [188790] branches/safari-601.1-branch/Source/WebCore
- Revision
- 188790
- Author
- [email protected]
- Date
- 2015-08-21 15:42:29 -0700 (Fri, 21 Aug 2015)
Log Message
Merge r188765. rdar://problem/22356782
Modified Paths
Diff
Modified: branches/safari-601.1-branch/Source/WebCore/ChangeLog (188789 => 188790)
--- branches/safari-601.1-branch/Source/WebCore/ChangeLog 2015-08-21 22:12:53 UTC (rev 188789)
+++ branches/safari-601.1-branch/Source/WebCore/ChangeLog 2015-08-21 22:42:29 UTC (rev 188790)
@@ -1,3 +1,26 @@
+2015-08-21 Matthew Hanson <[email protected]>
+
+ Merge r188765. rdar://problem/22356782
+
+ 2015-08-21 Beth Dakin <[email protected]>
+
+ HistoryItems will null CachedPages should never be left in the list of items;
+ causes crash
+ https://bugs.webkit.org/show_bug.cgi?id=148237
+ -and corresponding-
+ rdar://problem/22356782
+
+ Reviewed by Brady Eidson.
+
+ Setting the CachedPage to nullptr will destroy the CachedPage, destroy the
+ FrameView, re-enter layout, and potentially try to modify items in the PageCache
+ based on that layout. So, we should not modify CachedPage in this way while the
+ item is still in the list of HistoryItems.
+ * history/PageCache.cpp:
+ (WebCore::PageCache::take):
+ (WebCore::PageCache::remove):
+ (WebCore::PageCache::prune):
+
2015-08-17 Matthew Hanson <[email protected]>
Merge r188531. rdar://problem/22308554
Modified: branches/safari-601.1-branch/Source/WebCore/history/PageCache.cpp (188789 => 188790)
--- branches/safari-601.1-branch/Source/WebCore/history/PageCache.cpp 2015-08-21 22:12:53 UTC (rev 188789)
+++ branches/safari-601.1-branch/Source/WebCore/history/PageCache.cpp 2015-08-21 22:42:29 UTC (rev 188790)
@@ -468,8 +468,8 @@
return nullptr;
}
- std::unique_ptr<CachedPage> cachedPage = WTF::move(item.m_cachedPage);
m_items.remove(&item);
+ std::unique_ptr<CachedPage> cachedPage = WTF::move(item.m_cachedPage);
if (cachedPage->hasExpired()) {
LOG(PageCache, "Not restoring page for %s from back/forward cache because cache entry has expired", item.url().string().ascii().data());
@@ -504,17 +504,16 @@
if (!item.m_cachedPage)
return;
- item.m_cachedPage = nullptr;
m_items.remove(&item);
+ item.m_cachedPage = nullptr;
}
void PageCache::prune(PruningReason pruningReason)
{
while (pageCount() > maxSize()) {
- auto& oldestItem = m_items.first();
+ auto oldestItem = m_items.takeFirst();
oldestItem->m_cachedPage = nullptr;
oldestItem->m_pruningReason = pruningReason;
- m_items.removeFirst();
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
