Title: [199422] releases/WebKitGTK/webkit-2.12/Source/WebCore
- Revision
- 199422
- Author
- [email protected]
- Date
- 2016-04-13 00:39:03 -0700 (Wed, 13 Apr 2016)
Log Message
Merge r198471 - Data URL DecodeTask may get deleted outside main thread
https://bugs.webkit.org/show_bug.cgi?id=155584
rdar://problem/24492104
Reviewed by David Kilzer.
Follow-up: fix a possible null pointer crash.
* platform/network/DataURLDecoder.cpp:
(WebCore::DataURLDecoder::DecodingResultDispatcher::startTimer):
If timer fires under startOneShot m_decodeTask may become zero before schedule() is called.
Fix by copying schedule context to a local before calling startOneShot.
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog (199421 => 199422)
--- releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog 2016-04-13 07:37:03 UTC (rev 199421)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog 2016-04-13 07:39:03 UTC (rev 199422)
@@ -1,3 +1,19 @@
+2016-03-19 Antti Koivisto <[email protected]>
+
+ Data URL DecodeTask may get deleted outside main thread
+ https://bugs.webkit.org/show_bug.cgi?id=155584
+ rdar://problem/24492104
+
+ Reviewed by David Kilzer.
+
+ Follow-up: fix a possible null pointer crash.
+
+ * platform/network/DataURLDecoder.cpp:
+ (WebCore::DataURLDecoder::DecodingResultDispatcher::startTimer):
+
+ If timer fires under startOneShot m_decodeTask may become zero before schedule() is called.
+ Fix by copying schedule context to a local before calling startOneShot.
+
2016-03-18 Darin Adler <[email protected]>
ASSERTION FAILED: m_isValid == valid() in WebCore::HTMLFormControlElement::isValidFormControlElement
Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/network/DataURLDecoder.cpp (199421 => 199422)
--- releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/network/DataURLDecoder.cpp 2016-04-13 07:37:03 UTC (rev 199421)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/network/DataURLDecoder.cpp 2016-04-13 07:39:03 UTC (rev 199422)
@@ -75,8 +75,10 @@
{
// Keep alive until the timer has fired.
ref();
+
+ auto scheduledPairs = m_decodeTask->scheduleContext.scheduledPairs;
m_timer.startOneShot(0);
- m_timer.schedule(m_decodeTask->scheduleContext.scheduledPairs);
+ m_timer.schedule(scheduledPairs);
}
void timerFired()
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
