Changeset 106636 in webkit

Timestamp:

Feb 3, 2012 12:19:06 AM (12 years ago)

Author:

jochen@chromium.org

Message:

Crash when trying to add a timer to a detached document.
​https://bugs.webkit.org/show_bug.cgi?id=77692

Reviewed by Alexey Proskuryakov.

In ​http://webkit.org/b/77370, a timer is fired on a detached document.
Since a document clears all timers when it is detached, and it
shouldn't be possible to add a timer to a detached document, we crash
if this should happen anyway. This will hopefully result in an easier
to debug crash dump.

• page/DOMTimer.cpp:

(WebCore::DOMTimer::DOMTimer):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• page/DOMTimer.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-02-03  Jochen Eisinger  <jochen@chromium.org>
+
+        Crash when trying to add a timer to a detached document.
+        https://bugs.webkit.org/show_bug.cgi?id=77692
+
+        Reviewed by Alexey Proskuryakov.
+
+        In http://webkit.org/b/77370, a timer is fired on a detached document.
+        Since a document clears all timers when it is detached, and it
+        shouldn't be possible to add a timer to a detached document, we crash
+        if this should happen anyway. This will hopefully result in an easier
+        to debug crash dump.
+
+        * page/DOMTimer.cpp:
+        (WebCore::DOMTimer::DOMTimer):
+
 2012-02-03  Shinya Kawanaka  <shinyak@google.com>
 

trunk/Source/WebCore/page/DOMTimer.cpp

@@ -28 +28 @@
 #include "DOMTimer.h"
 
+#include "Document.h"
 #include "InspectorInstrumentation.h"
 #include "ScheduledAction.h"
@@ -71 +72 @@
     , m_shouldForwardUserGesture(shouldForwardUserGesture(interval, m_nestingLevel))
 {
+    // FIXME: remove once we found out the root cause for http://webkit.org/b/77370
+    if (scriptExecutionContext()->isDocument() && !static_cast<Document*>(scriptExecutionContext())->frame())
+        CRASH();
     scriptExecutionContext()->addTimeout(m_timeoutId, this);