Changeset 200986 in webkit


Ignore:
Timestamp:
May 16, 2016, 6:09:27 PM (9 years ago)
Author:
Brent Fulgham
Message:

heap use-after-free at WebCore::TimerBase::heapPopMin()
​https://bugs.webkit.org/show_bug.cgi?id=157742
<rdar://problem/26236778>

Source/WebCore:

Reviewed by David Kilzer.

Tested by fast/frames/resources/crash-during-iframe-load-stop.html.

  • loader/FrameLoader.cpp:

(WebCore::FrameLoader::stopForUserCancel): Protect m_frame from destruction while it is still
being used by the current stack frame.
(WebCore::FrameLoader::frameDetached): Ditto.
(WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy): Ditto.

LayoutTests:

Reviewed by Simon Fraser.

  • fast/frames/crash-during-iframe-load-stop-expected.txt: Added.
  • fast/frames/crash-during-iframe-load-stop.html: Added.
  • fast/frames/resources/crash-during-iframe-load-stop-inner.html: Added.
  • fast/frames/resources/crash-during-iframe-load-stop.html: Added.
Location:
trunk
Files:
4 added
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r200981 r200986  
     12016-05-16  Brent Fulgham  <bfulgham@apple.com>
     2
     3        heap use-after-free at WebCore::TimerBase::heapPopMin()
     4        https://bugs.webkit.org/show_bug.cgi?id=157742
     5        <rdar://problem/26236778>
     6
     7        Reviewed by Simon Fraser.
     8
     9        * fast/frames/crash-during-iframe-load-stop-expected.txt: Added.
     10        * fast/frames/crash-during-iframe-load-stop.html: Added.
     11        * fast/frames/resources/crash-during-iframe-load-stop-inner.html: Added.
     12        * fast/frames/resources/crash-during-iframe-load-stop.html: Added.
     13
    1142016-05-16  Saam barati  <sbarati@apple.com>
    215

  • trunk/Source/WebCore/ChangeLog

    r200985 r200986  
     12016-05-16  Brent Fulgham  <bfulgham@apple.com>
     2
     3        heap use-after-free at WebCore::TimerBase::heapPopMin()
     4        https://bugs.webkit.org/show_bug.cgi?id=157742
     5        <rdar://problem/26236778>
     6
     7        Reviewed by David Kilzer.
     8
     9        Tested by fast/frames/resources/crash-during-iframe-load-stop.html.
     10
     11        * loader/FrameLoader.cpp:
     12        (WebCore::FrameLoader::stopForUserCancel): Protect m_frame from destruction while it is still
     13        being used by the current stack frame.
     14        (WebCore::FrameLoader::frameDetached): Ditto.
     15        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy): Ditto.
     16
    1172016-05-16  Dean Jackson  <dino@apple.com>
    218

  • trunk/Source/WebCore/loader/FrameLoader.cpp

    r199955 r200986  
    16331633void FrameLoader::stopForUserCancel(bool deferCheckLoadComplete)
    16341634{
     1635    // Calling stopAllLoaders can cause the frame to be deallocated, including the frame loader.
     1636    Ref<Frame> protectedFrame(m_frame);
     1637
    16351638    stopAllLoaders();
    16361639
    … …  
    24922495void FrameLoader::frameDetached()
    24932496{
     2497    // Calling stopAllLoaders can cause the frame to be deallocated, including the frame loader.
     2498    Ref<Frame> protectedFrame(m_frame);
     2499
    24942500    stopAllLoaders();
    24952501    m_frame.document()->stopActiveDOMObjects();
    … …  
    27902796    if (!shouldContinue)
    27912797        return;
     2798
     2799    // Calling stopLoading() on the provisional document loader can cause the underlying
     2800    // frame to be deallocated.
     2801    Ref<Frame> protectedFrame(m_frame);
    27922802
    27932803    // If we have a provisional request for a different document, a fragment scroll should cancel it.
Note: See TracChangeset for help on using the changeset viewer.