Changeset 185403 in webkit

Timestamp:

Jun 9, 2015, 10:59:54 PM (11 years ago)

Author:

Alan Bujtas

Message:

Protect FrameView from being destroyed in Document::recalcStyle()
​https://bugs.webkit.org/show_bug.cgi?id=143033
rdar://problem/20326871

Reviewed by Andreas Kling.

This patch ensures that FrameView stays valid in Document::recalcStyle().
It follows the defensive pattern we use to deal with the refcounted FrameView (see EventDispatcher::dispatchEvent)

When the iframe destroys itself in the onBeforeLoad callback (as the result of
PostResolutionCallbackDisabler -> HTMLObjectElement::updateWidget -> guardedDispatchBeforeLoadEvent),
we detach the frame and release the FrameView. However Document::recalcStyle() expects
the FrameView to stay valid.

Covered by fast/frames/flattening/crash-remove-iframe-during-object-beforeload.html.

• dom/Document.cpp:

(WebCore::Document::recalcStyle):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• dom/Document.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2015-06-09  Zalan Bujtas  <zalan@apple.com>
+
+        Protect FrameView from being destroyed in Document::recalcStyle()
+        https://bugs.webkit.org/show_bug.cgi?id=143033
+        rdar://problem/20326871
+
+        Reviewed by Andreas Kling.
+
+        This patch ensures that FrameView stays valid in Document::recalcStyle().
+        It follows the defensive pattern we use to deal with the refcounted FrameView (see EventDispatcher::dispatchEvent)
+
+        When the iframe destroys itself in the onBeforeLoad callback (as the result of
+        PostResolutionCallbackDisabler -> HTMLObjectElement::updateWidget -> guardedDispatchBeforeLoadEvent),
+        we detach the frame and release the FrameView. However Document::recalcStyle() expects
+        the FrameView to stay valid.
+
+        Covered by fast/frames/flattening/crash-remove-iframe-during-object-beforeload.html.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+
 2015-06-09  Daegyu Lee  <daegyu.lee@navercorp.com>
 

trunk/Source/WebCore/dom/Document.cpp

@@ -1739 +1739 @@
 
     FrameView& frameView = m_renderView->frameView();
+    Ref<FrameView> protect(frameView);
     if (frameView.isPainting())
         return;