Changeset 204631 in webkit


Ignore:
Timestamp:
Aug 19, 2016 8:46:42 AM (8 years ago)
Author:
Chris Dumez
Message:

DumpRenderTree crashed in com.apple.WebCore: WebCore::DOMWindow::resetDOMWindowProperties + 607
https://bugs.webkit.org/show_bug.cgi?id=160983
<rdar://problem/26768524>

Reviewed by Brent Fulgham.

Update DOMWindow::frameDestroyed() to ref the window object as the crash
traces seem to indicate it can get destroyed during the execution of this
method. Also update the code in the ~Frame destructor to not iterate over
the list of FrameDestructionObservers because observers remove themselves
from the list when they get destroyed.

No new tests, do not know how to reproduce.

  • page/DOMWindow.cpp:

(WebCore::DOMWindow::frameDestroyed):

  • page/Frame.cpp:

(WebCore::Frame::~Frame):

Location:
trunk/Source/WebCore
Files:
3 edited

Legend:

Unmodified
Added
Removed
  • trunk/Source/WebCore/ChangeLog

    r204630 r204631  
     12016-08-19  Chris Dumez  <cdumez@apple.com>
     2
     3        DumpRenderTree crashed in com.apple.WebCore: WebCore::DOMWindow::resetDOMWindowProperties + 607
     4        https://bugs.webkit.org/show_bug.cgi?id=160983
     5        <rdar://problem/26768524>
     6
     7        Reviewed by Brent Fulgham.
     8
     9        Update DOMWindow::frameDestroyed() to ref the window object as the crash
     10        traces seem to indicate it can get destroyed during the execution of this
     11        method. Also update the code in the ~Frame destructor to not iterate over
     12        the list of FrameDestructionObservers because observers remove themselves
     13        from the list when they get destroyed.
     14
     15        No new tests, do not know how to reproduce.
     16
     17        * page/DOMWindow.cpp:
     18        (WebCore::DOMWindow::frameDestroyed):
     19        * page/Frame.cpp:
     20        (WebCore::Frame::~Frame):
     21
    1222016-08-19  Chris Dumez  <cdumez@apple.com>
    223
  • trunk/Source/WebCore/page/DOMWindow.cpp

    r204429 r204631  
    482482void DOMWindow::frameDestroyed()
    483483{
     484    Ref<DOMWindow> protectedThis(*this);
     485
    484486    willDestroyDocumentInFrame();
    485487    FrameDestructionObserver::frameDestroyed();
  • trunk/Source/WebCore/page/Frame.cpp

    r203324 r204631  
    218218    disconnectOwnerElement();
    219219
    220     for (auto& observer : m_destructionObservers)
    221         observer->frameDestroyed();
     220    while (auto* destructionObserver = m_destructionObservers.takeAny())
     221        destructionObserver->frameDestroyed();
    222222
    223223    if (!isMainFrame())
Note: See TracChangeset for help on using the changeset viewer.