Changeset 189979 in webkit

Timestamp:

Sep 18, 2015 1:37:41 PM (9 years ago)

Author:

Chris Dumez

Message:

WebContent crash in WebCore::MemoryPressureHandler::releaseCriticalMemory() with GuardMalloc when preparing to suspend
​https://bugs.webkit.org/show_bug.cgi?id=149350

Reviewed by Antti Koivisto.

in MemoryPressureHandler::releaseCriticalMemory(), iterate over a copy of
Document::allDocuments() instead of iterating over allDocuments() directly.
Also make sure the Documents are ref'd inside the copy.

This is needed because clearing the StyleResolver of a Document may cause
Documents to be unref'd and removed from the allDocument() HashSet.

No new tests, already covered by existing tests.

• platform/MemoryPressureHandler.cpp:

(WebCore::MemoryPressureHandler::releaseCriticalMemory):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/MemoryPressureHandler.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2015-09-18  Chris Dumez  <cdumez@apple.com>
+
+        WebContent crash in WebCore::MemoryPressureHandler::releaseCriticalMemory() with GuardMalloc when preparing to suspend
+        https://bugs.webkit.org/show_bug.cgi?id=149350
+
+        Reviewed by Antti Koivisto.
+
+        in MemoryPressureHandler::releaseCriticalMemory(), iterate over a copy of
+        Document::allDocuments() instead of iterating over allDocuments() directly.
+        Also make sure the Documents are ref'd inside the copy.
+
+        This is needed because clearing the StyleResolver of a Document may cause
+        Documents to be unref'd and removed from the allDocument() HashSet.
+
+        No new tests, already covered by existing tests.
+
+        * platform/MemoryPressureHandler.cpp:
+        (WebCore::MemoryPressureHandler::releaseCriticalMemory):
+
 2015-09-18  Brent Fulgham  <bfulgham@apple.com>
 

trunk/Source/WebCore/platform/MemoryPressureHandler.cpp

@@ -130 +130 @@
     {
         ReliefLogger log("Discard StyleResolvers");
-        for (auto* document : Document::allDocuments())
+        Vector<RefPtr<Document>> documents;
+        copyToVector(Document::allDocuments(), documents);
+        for (auto& document : documents)
             document->clearStyleResolver();
     }