Changeset 229179 in webkit
- Timestamp:
- Mar 2, 2018 9:52:17 AM (6 years ago)
- Location:
- trunk
- Files:
-
- 2 added
- 3 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r229177 r229179 1 2018-03-02 Chris Dumez <cdumez@apple.com> 2 3 fast/events/before-unload-remove-itself.html crashes with async policy delegates 4 https://bugs.webkit.org/show_bug.cgi?id=183290 5 <rdar://problem/38069045> 6 7 Reviewed by Alex Christensen. 8 9 Add layout test coverage. 10 11 * fast/events/before-unload-remove-itself-async-delegate-expected.txt: Added. 12 * fast/events/before-unload-remove-itself-async-delegate.html: Added. 13 1 14 2018-03-02 Chris Dumez <cdumez@apple.com> 2 15 -
trunk/Source/WebCore/ChangeLog
r229177 r229179 1 2018-03-02 Chris Dumez <cdumez@apple.com> 2 3 fast/events/before-unload-remove-itself.html crashes with async policy delegates 4 https://bugs.webkit.org/show_bug.cgi?id=183290 5 <rdar://problem/38069045> 6 7 Reviewed by Alex Christensen. 8 9 When the navigation policy happens asynchronously, it is now possible for the 10 Frame / FrameLoader to get destroyed between the point that policyChecker().checkNavigationPolicy() 11 is called and when continueLoadAfterNavigationPolicy() is called. 12 13 To address the issue, we now protect the Frame and capture it in the lambda passed 14 to policyChecker().checkNavigationPolicy(). 15 16 Test: fast/events/before-unload-remove-itself-async-delegate.html 17 18 * loader/FrameLoader.cpp: 19 (WebCore::FrameLoader::loadURL): 20 (WebCore::FrameLoader::loadWithDocumentLoader): 21 1 22 2018-03-02 Chris Dumez <cdumez@apple.com> 2 23 -
trunk/Source/WebCore/loader/FrameLoader.cpp
r229108 r229179 1327 1327 policyChecker().setLoadType(newLoadType); 1328 1328 auto completionHandlerCalled = adoptRef(*new SharedBool); 1329 policyChecker().checkNavigationPolicy(ResourceRequest(request), false /* didReceiveRedirectResponse */, oldDocumentLoader.get(), formState, [this, completionHandlerCalled = completionHandlerCalled.copyRef()] (const ResourceRequest& request, FormState*, bool shouldContinue) {1329 policyChecker().checkNavigationPolicy(ResourceRequest(request), false /* didReceiveRedirectResponse */, oldDocumentLoader.get(), formState, [this, protectedFrame = makeRef(m_frame), completionHandlerCalled = completionHandlerCalled.copyRef()] (const ResourceRequest& request, FormState*, bool shouldContinue) { 1330 1330 if (!completionHandlerCalled->value) { 1331 1331 completionHandlerCalled->value = true; … … 1497 1497 policyChecker().stopCheck(); 1498 1498 auto completionHandlerCalled = adoptRef(*new SharedBool); 1499 policyChecker().checkNavigationPolicy(ResourceRequest(loader->request()), false /* didReceiveRedirectResponse */, oldDocumentLoader.get(), formState, [this, completionHandlerCalled = completionHandlerCalled.copyRef()] (const ResourceRequest& request, FormState*, bool shouldContinue) {1499 policyChecker().checkNavigationPolicy(ResourceRequest(loader->request()), false /* didReceiveRedirectResponse */, oldDocumentLoader.get(), formState, [this, protectedFrame = makeRef(m_frame), completionHandlerCalled = completionHandlerCalled.copyRef()] (const ResourceRequest& request, FormState*, bool shouldContinue) { 1500 1500 if (!completionHandlerCalled->value) { 1501 1501 completionHandlerCalled->value = true; … … 1533 1533 m_frame.navigationScheduler().cancel(true); 1534 1534 1535 policyChecker().checkNavigationPolicy(ResourceRequest(loader->request()), false /* didReceiveRedirectResponse */, loader, formState, [this, allowNavigationToInvalidURL] (const ResourceRequest& request, FormState* formState, bool shouldContinue) {1535 policyChecker().checkNavigationPolicy(ResourceRequest(loader->request()), false /* didReceiveRedirectResponse */, loader, formState, [this, protectedFrame = makeRef(m_frame), allowNavigationToInvalidURL] (const ResourceRequest& request, FormState* formState, bool shouldContinue) { 1536 1536 continueLoadAfterNavigationPolicy(request, formState, shouldContinue, allowNavigationToInvalidURL); 1537 1537 });
Note: See TracChangeset
for help on using the changeset viewer.