Changeset 77705 in webkit
- Timestamp:
- Feb 4, 2011, 4:48:31 PM (14 years ago)
- Location:
- trunk
- Files:
-
- 2 added
- 6 edited
-
LayoutTests/ChangeLog (modified) (1 diff)
-
LayoutTests/fast/history/history-back-forward-within-subframe-hash-expected.txt (added)
-
LayoutTests/fast/history/history-back-forward-within-subframe-hash.html (added)
-
Source/WebCore/ChangeLog (modified) (1 diff)
-
Source/WebCore/loader/HistoryController.cpp (modified) (7 diffs)
-
Source/WebCore/loader/HistoryController.h (modified) (1 diff)
-
Source/WebKit/chromium/ChangeLog (modified) (1 diff)
-
Source/WebKit/chromium/src/WebFrameImpl.cpp (modified) (1 diff)
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r77704 r77705 1 2011-02-04 Charlie Reis <creis@chromium.org> 2 3 Reviewed by Mihai Parparita. 4 5 Crash in WebCore::HistoryController::itemsAreClones 6 https://bugs.webkit.org/show_bug.cgi?id=52819 7 8 Tests that navigating back and forward between hash items works. 9 10 * fast/history/history-back-forward-within-subframe-hash.html: Added. 11 * fast/history/history-back-forward-within-subframe-hash-expected.txt: Added. 12 1 13 2011-02-04 Dimitri Glazkov <dglazkov@chromium.org> 2 14 -
trunk/Source/WebCore/ChangeLog
r77702 r77705 1 2011-02-04 Charlie Reis <creis@chromium.org> 2 3 Reviewed by Mihai Parparita. 4 5 Crash in WebCore::HistoryController::itemsAreClones 6 https://bugs.webkit.org/show_bug.cgi?id=52819 7 8 Avoids deleting the current HistoryItem while it is still in use. 9 Ensures that provisional items are committed for same document navigations. 10 Ensures that error pages are committed on back/forward navigations. 11 Also removes unneeded sanity checks used for diagnosing the problem. 12 13 * loader/HistoryController.cpp: 14 * loader/HistoryController.h: 15 1 16 2011-02-04 Carol Szabo <carol.szabo@nokia.com> 2 17 -
trunk/Source/WebCore/loader/HistoryController.cpp
r77210 r77705 237 237 // - plus, it only makes sense for the top level of the operation through the frametree, 238 238 // as opposed to happening for some/one of the page commits that might happen soon 239 HistoryItem* currentItem = page->backForward()->currentItem();239 RefPtr<HistoryItem> currentItem = page->backForward()->currentItem(); 240 240 page->backForward()->setCurrentItem(targetItem); 241 241 Settings* settings = m_frame->settings(); … … 246 246 // navigations can commit immediately (such as about:blank). We must be sure that 247 247 // all frames have provisional items set before the commit. 248 recursiveSetProvisionalItem(targetItem, currentItem , type);248 recursiveSetProvisionalItem(targetItem, currentItem.get(), type); 249 249 // Now that all other frames have provisional items, do the actual navigation. 250 recursiveGoToItem(targetItem, currentItem , type);250 recursiveGoToItem(targetItem, currentItem.get(), type); 251 251 } 252 252 … … 403 403 #endif 404 404 FrameLoadType type = frameLoader->loadType(); 405 if (isBackForwardLoadType(type) || 406 ((type == FrameLoadTypeReload || type == FrameLoadTypeReloadFromOrigin) && !frameLoader->provisionalDocumentLoader()->unreachableURL().isEmpty())) { 405 if (isBackForwardLoadType(type) 406 || isReplaceLoadTypeWithProvisionalItem(type) 407 || ((type == FrameLoadTypeReload || type == FrameLoadTypeReloadFromOrigin) && !frameLoader->provisionalDocumentLoader()->unreachableURL().isEmpty())) { 407 408 // Once committed, we want to use current item for saving DocState, and 408 409 // the provisional item for restoring state. … … 424 425 } 425 426 427 bool HistoryController::isReplaceLoadTypeWithProvisionalItem(FrameLoadType type) 428 { 429 // Going back to an error page in a subframe can trigger a FrameLoadTypeReplace 430 // while m_provisionalItem is set, so we need to commit it. 431 return type == FrameLoadTypeReplace && m_provisionalItem; 432 } 433 426 434 void HistoryController::recursiveUpdateForCommit() 427 435 { … … 472 480 473 481 addVisitedLink(page, m_frame->document()->url()); 482 page->mainFrame()->loader()->history()->recursiveUpdateForSameDocumentNavigation(); 483 } 484 485 void HistoryController::recursiveUpdateForSameDocumentNavigation() 486 { 487 // The frame that navigated will now have a null provisional item. 488 // Ignore it and its children. 489 if (!m_provisionalItem) 490 return; 491 492 // Commit the provisional item. 493 m_frameLoadComplete = false; 494 m_previousItem = m_currentItem; 495 m_currentItem = m_provisionalItem; 496 m_provisionalItem = 0; 497 498 // Iterate over the rest of the tree. 499 for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling()) 500 child->loader()->history()->recursiveUpdateForSameDocumentNavigation(); 474 501 } 475 502 … … 621 648 622 649 int size = childItems.size(); 623 624 // Sanity checks for http://webkit.org/b/52819.625 if (size > 0) {626 // fromItem should have same number of children according to hasSameFrames,627 // but crash dumps suggest it might have 0.628 if (!fromItem->children().size())629 CRASH();630 // itemsAreClones checked fromItem->hasSameFrames(item). Check vice versa.631 if (!item->hasSameFrames(fromItem))632 CRASH();633 }634 650 635 651 for (int i = 0; i < size; ++i) { … … 671 687 bool HistoryController::itemsAreClones(HistoryItem* item1, HistoryItem* item2) const 672 688 { 673 // It appears that one of the items can be null in release builds, leading674 // to the crashes seen in http://webkit.org/b/52819. For now, try to675 // narrow it down with a more specific crash.676 if (!item1)677 CRASH();678 if (!item2)679 CRASH();680 681 689 // If the item we're going to is a clone of the item we're at, then we do 682 690 // not need to load it again. The current frame tree and the frame tree -
trunk/Source/WebCore/loader/HistoryController.h
r76248 r77705 92 92 void recursiveSetProvisionalItem(HistoryItem*, HistoryItem*, FrameLoadType); 93 93 void recursiveGoToItem(HistoryItem*, HistoryItem*, FrameLoadType); 94 bool isReplaceLoadTypeWithProvisionalItem(FrameLoadType); 94 95 void recursiveUpdateForCommit(); 96 void recursiveUpdateForSameDocumentNavigation(); 95 97 bool itemsAreClones(HistoryItem*, HistoryItem*) const; 96 98 bool currentFramesMatchItem(HistoryItem*) const; -
trunk/Source/WebKit/chromium/ChangeLog
r77687 r77705 1 2011-02-04 Charlie Reis <creis@chromium.org> 2 3 Reviewed by Mihai Parparita. 4 5 Crash in WebCore::HistoryController::itemsAreClones 6 https://bugs.webkit.org/show_bug.cgi?id=52819 7 8 Removes unneeded sanity checks used for diagnosing a memory error. 9 10 * src/WebFrameImpl.cpp: 11 1 12 2011-02-04 Daniel Cheng <dcheng@chromium.org> 2 13 -
trunk/Source/WebKit/chromium/src/WebFrameImpl.cpp
r77687 r77705 882 882 ASSERT(historyItem.get()); 883 883 884 // Sanity check for http://webkit.org/b/52819. It appears that some child885 // items of this item might be null. Try validating just the first set of886 // children in an attempt to catch it early.887 const HistoryItemVector& childItems = historyItem->children();888 int size = childItems.size();889 for (int i = 0; i < size; ++i) {890 RefPtr<HistoryItem> childItem = childItems[i].get();891 if (!childItem.get())892 CRASH();893 }894 895 884 // If there is no currentItem, which happens when we are navigating in 896 885 // session history after a crash, we need to manufacture one otherwise WebKit
Note:
See TracChangeset
for help on using the changeset viewer.