Changeset 167790 in webkit

Timestamp:

Apr 24, 2014, 11:01:34 PM (12 years ago)

Author:

Darin Adler

Message:

FrameLoader::checkCompleted can hit the "ref'ing while destroyed" assertion
​https://bugs.webkit.org/show_bug.cgi?id=132163
rdar://problem/16720640

Reviewed by Brady Eidson.

Couldn't find a way to test this yet. Would be nice to have a test.

• loader/FrameLoader.cpp:

(WebCore::FrameLoader::checkCompleted): Move protector until after we check
if the frame is already complete. That can happen in practice when this is
called from within the frame's destructor. All the code that runs before the
protector simply checks state and does not require protection.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• loader/FrameLoader.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-04-24  Darin Adler  <darin@apple.com>
+
+        FrameLoader::checkCompleted can hit the "ref'ing while destroyed" assertion
+        https://bugs.webkit.org/show_bug.cgi?id=132163
+        rdar://problem/16720640
+
+        Reviewed by Brady Eidson.
+
+        Couldn't find a way to test this yet. Would be nice to have a test.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkCompleted): Move protector until after we check
+        if the frame is already complete. That can happen in practice when this is
+        called from within the frame's destructor. All the code that runs before the
+        protector simply checks state and does not require protection.
+
 2014-04-24  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
 

trunk/Source/WebCore/loader/FrameLoader.cpp

@@ -794 +794 @@
 void FrameLoader::checkCompleted()
 {
-    Ref<Frame> protect(m_frame);
     m_shouldCallCheckCompleted = false;
 
@@ -816 +815 @@
     if (!allChildrenAreComplete())
         return;
+
+    // Important not to protect earlier in this function, because earlier parts
+    // of this function can be called the frame's destructor, and it's not legal
+    // to ref an object while it's being destroyed.
+    Ref<Frame> protect(m_frame);
 
     // OK, completed.