Changeset 188712 in webkit

Timestamp:

Aug 20, 2015 3:37:22 PM (9 years ago)

Author:

Beth Dakin

Message:

WK1 can re-enter layout during FrameView destruction and crash
​https://bugs.webkit.org/show_bug.cgi?id=148237
-and corresponding-
rdar://problem/22356782

Reviewed by Zalan Bujtas.

This is a safe fix for the time being. We won't resetScrollbars() for a FrameView
that is in the PageCache because resetting scrollbars can re-enter layout for the
Frame's new FrameView, which leads to updating pages in the page cache, which
leads to a crash because we're in the process of destroying something
in the page cache. We should not be able to get into this mess at all.

• page/FrameView.cpp:

(WebCore::FrameView::~FrameView):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• page/FrameView.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2015-08-20  Beth Dakin  <bdakin@apple.com>
+
+        WK1 can re-enter layout during FrameView destruction and crash
+        https://bugs.webkit.org/show_bug.cgi?id=148237
+        -and corresponding-
+        rdar://problem/22356782
+
+        Reviewed by Zalan Bujtas.
+
+        This is a safe fix for the time being. We won't resetScrollbars() for a FrameView 
+        that is in the PageCache because resetting scrollbars can re-enter layout for the 
+        Frame's new FrameView, which leads to updating pages in the page cache, which 
+        leads to a crash because we're in the process of destroying something
+        in the page cache. We should not be able to get into this mess at all.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::~FrameView):
+
 2015-08-20  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/page/FrameView.cpp

@@ -268 +268 @@
     
     removeFromAXObjectCache();
-    resetScrollbars();
+
+    // FIXME: This is a safe fix for rdar://problem/22356782. We won't resetScrollbars() for a FrameView that is in
+    // the PageCache because resetting scrollbars can re-enter layout for the Frame's new FrameView, which leads to
+    // updating pages in the page cache, which leads to a crash because we're in the process of destroying something
+    // in the page cache. We should not be able to get into this mess at all.
+    if (frame().view() == this)
+        resetScrollbars();
 
     // Custom scrollbars should already be destroyed at this point