Changeset 119918 in webkit


Ignore:
Timestamp:
Jun 9, 2012 4:03:25 PM (12 years ago)
Author:
commit-queue@webkit.org
Message:

Unreviewed, rolling out r118618 and r119353.
​http://trac.webkit.org/changeset/118618
​http://trac.webkit.org/changeset/119353
​https://bugs.webkit.org/show_bug.cgi?id=88720

Caused at least 30 different crashes on ClusterFuzz (Requested
by inferno-sec on #webkit).

Patch by Sheriff Bot <​webkit.review.bot@gmail.com> on 2012-06-09

Source/WebCore:

  • loader/SubresourceLoader.cpp:

(WebCore::SubresourceLoader::checkForHTTPStatusCodeError):

  • loader/cache/CachedCSSStyleSheet.cpp:

(WebCore::CachedCSSStyleSheet::allClientsRemoved):

  • loader/cache/CachedFont.cpp:

(WebCore::CachedFont::allClientsRemoved):

  • loader/cache/CachedFont.h:

(WebCore::CachedFontClient::resourceClientType):

  • loader/cache/CachedImage.cpp:

(WebCore::CachedImage::removeClientForRenderer):
(WebCore):
(WebCore::CachedImage::allClientsRemoved):
(WebCore::CachedImage::lookupOrCreateImageForRenderer):

  • loader/cache/CachedImage.h:

(CachedImage):
(WebCore::CachedImageClient::resourceClientType):

  • loader/cache/CachedRawResource.cpp:

(WebCore::CachedRawResource::allClientsRemoved):
(WebCore):

  • loader/cache/CachedRawResource.h:

(CachedRawResource):
(WebCore::CachedRawResourceClient::resourceClientType):

  • loader/cache/CachedResource.cpp:

(WebCore::CachedResource::removeClient):

  • loader/cache/CachedResource.h:

(WebCore::CachedResource::allClientsRemoved):

  • loader/cache/CachedResourceClient.h:

(WebCore::CachedResourceClient::resourceClientType):

  • loader/cache/CachedSVGDocument.h:

(WebCore::CachedSVGDocumentClient::resourceClientType):

  • loader/cache/CachedScript.cpp:

(WebCore::CachedScript::allClientsRemoved):

  • loader/cache/CachedStyleSheetClient.h:

(WebCore::CachedStyleSheetClient::resourceClientType):

  • rendering/style/StyleCachedImage.cpp:

(WebCore::StyleCachedImage::removeClient):

  • rendering/style/StyleCachedImageSet.cpp:

(WebCore::StyleCachedImageSet::removeClient):

  • svg/graphics/SVGImageCache.cpp:

(WebCore::SVGImageCache::~SVGImageCache):
(WebCore::SVGImageCache::removeRendererFromCache):
(WebCore::SVGImageCache::setRequestedSizeAndScales):
(WebCore::SVGImageCache::requestedSizeAndScales):
(WebCore::SVGImageCache::lookupOrCreateBitmapImageForRenderer):

  • svg/graphics/SVGImageCache.h:

(WebCore):
(SVGImageCache):

LayoutTests:

  • http/tests/cache/cancel-in-progress-load-expected.txt: Removed.
  • http/tests/cache/cancel-in-progress-load.html: Removed.
  • http/tests/misc/write-while-waiting.html:
  • svg/as-image/svg-image-leak-cached-data-expected.txt: Removed.
  • svg/as-image/svg-image-leak-cached-data.html: Removed.
Location:
trunk
Files:
4 deleted
21 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r119917 r119918  
     12012-06-09  Sheriff Bot  <webkit.review.bot@gmail.com>
     2
     3        Unreviewed, rolling out r118618 and r119353.
     4        http://trac.webkit.org/changeset/118618
     5        http://trac.webkit.org/changeset/119353
     6        https://bugs.webkit.org/show_bug.cgi?id=88720
     7
     8        Caused at least 30 different crashes on ClusterFuzz (Requested
     9        by inferno-sec on #webkit).
     10
     11        * http/tests/cache/cancel-in-progress-load-expected.txt: Removed.
     12        * http/tests/cache/cancel-in-progress-load.html: Removed.
     13        * http/tests/misc/write-while-waiting.html:
     14        * svg/as-image/svg-image-leak-cached-data-expected.txt: Removed.
     15        * svg/as-image/svg-image-leak-cached-data.html: Removed.
     16
    1172012-06-09  Ryosuke Niwa  <rniwa@webkit.org>
    218

  • trunk/LayoutTests/http/tests/misc/write-while-waiting.html

    r118618 r119918  
    33FAIL
    44<script>
    5 if (window.layoutTestController) {
     5if (window.layoutTestController)
    66    layoutTestController.dumpAsText();
    7     layoutTestController.waitUntilDone();
    8 }
    97
    10 setTimeout("document.write('PASS');document.close(); if (window.layoutTestController) layoutTestController.notifyDone();", 100);
     8setTimeout("document.write('PASS');document.close();", 100);
    119</script>
    1210<script src="resources/script-slow1.pl"></script>

  • trunk/Source/WebCore/ChangeLog

    r119914 r119918  
     12012-06-09  Sheriff Bot  <webkit.review.bot@gmail.com>
     2
     3        Unreviewed, rolling out r118618 and r119353.
     4        http://trac.webkit.org/changeset/118618
     5        http://trac.webkit.org/changeset/119353
     6        https://bugs.webkit.org/show_bug.cgi?id=88720
     7
     8        Caused at least 30 different crashes on ClusterFuzz (Requested
     9        by inferno-sec on #webkit).
     10
     11        * loader/SubresourceLoader.cpp:
     12        (WebCore::SubresourceLoader::checkForHTTPStatusCodeError):
     13        * loader/cache/CachedCSSStyleSheet.cpp:
     14        (WebCore::CachedCSSStyleSheet::allClientsRemoved):
     15        * loader/cache/CachedFont.cpp:
     16        (WebCore::CachedFont::allClientsRemoved):
     17        * loader/cache/CachedFont.h:
     18        (WebCore::CachedFontClient::resourceClientType):
     19        * loader/cache/CachedImage.cpp:
     20        (WebCore::CachedImage::removeClientForRenderer):
     21        (WebCore):
     22        (WebCore::CachedImage::allClientsRemoved):
     23        (WebCore::CachedImage::lookupOrCreateImageForRenderer):
     24        * loader/cache/CachedImage.h:
     25        (CachedImage):
     26        (WebCore::CachedImageClient::resourceClientType):
     27        * loader/cache/CachedRawResource.cpp:
     28        (WebCore::CachedRawResource::allClientsRemoved):
     29        (WebCore):
     30        * loader/cache/CachedRawResource.h:
     31        (CachedRawResource):
     32        (WebCore::CachedRawResourceClient::resourceClientType):
     33        * loader/cache/CachedResource.cpp:
     34        (WebCore::CachedResource::removeClient):
     35        * loader/cache/CachedResource.h:
     36        (WebCore::CachedResource::allClientsRemoved):
     37        * loader/cache/CachedResourceClient.h:
     38        (WebCore::CachedResourceClient::resourceClientType):
     39        * loader/cache/CachedSVGDocument.h:
     40        (WebCore::CachedSVGDocumentClient::resourceClientType):
     41        * loader/cache/CachedScript.cpp:
     42        (WebCore::CachedScript::allClientsRemoved):
     43        * loader/cache/CachedStyleSheetClient.h:
     44        (WebCore::CachedStyleSheetClient::resourceClientType):
     45        * rendering/style/StyleCachedImage.cpp:
     46        (WebCore::StyleCachedImage::removeClient):
     47        * rendering/style/StyleCachedImageSet.cpp:
     48        (WebCore::StyleCachedImageSet::removeClient):
     49        * svg/graphics/SVGImageCache.cpp:
     50        (WebCore::SVGImageCache::~SVGImageCache):
     51        (WebCore::SVGImageCache::removeRendererFromCache):
     52        (WebCore::SVGImageCache::setRequestedSizeAndScales):
     53        (WebCore::SVGImageCache::requestedSizeAndScales):
     54        (WebCore::SVGImageCache::lookupOrCreateBitmapImageForRenderer):
     55        * svg/graphics/SVGImageCache.h:
     56        (WebCore):
     57        (SVGImageCache):
     58
    1592012-06-09  Florin Malita  <fmalita@chromium.org>
    260

  • trunk/Source/WebCore/loader/SubresourceLoader.cpp

    r119759 r119918  
    235235        return false;
    236236
     237    m_resource->error(CachedResource::LoadError);
    237238    m_state = Finishing;
    238     m_resource->error(CachedResource::LoadError);
    239239    cancel();
    240240    return true;

  • trunk/Source/WebCore/loader/cache/CachedCSSStyleSheet.cpp

    r118618 r119918  
    6767    if (!MemoryCache::shouldMakeResourcePurgeableOnEviction() && isSafeToMakePurgeable())
    6868        makePurgeable(true);
    69     CachedResource::allClientsRemoved();
    7069}
    7170

  • trunk/Source/WebCore/loader/cache/CachedFont.cpp

    r118618 r119918  
    186186    }
    187187#endif
    188     CachedResource::allClientsRemoved();
    189188}
    190189

  • trunk/Source/WebCore/loader/cache/CachedFont.h

    r119353 r119918  
    8686    virtual ~CachedFontClient() { }
    8787    static CachedResourceClientType expectedType() { return FontType; }
    88     virtual CachedResourceClientType resourceClientType() const { return expectedType(); }
     88    virtual CachedResourceClientType resourceClientType() { return expectedType(); }
    8989    virtual void fontLoaded(CachedFont*) { }
    9090};

  • trunk/Source/WebCore/loader/cache/CachedImage.cpp

    r119353 r119918  
    9393}
    9494
     95void CachedImage::removeClientForRenderer(RenderObject* renderer)
     96{
     97#if ENABLE(SVG)
     98    if (m_svgImageCache)
     99        m_svgImageCache->removeRendererFromCache(renderer);
     100#endif
     101    removeClient(renderer);
     102}
     103
    95104void CachedImage::didAddClient(CachedResourceClient* c)
    96105{
    … …  
    108117
    109118    CachedResource::didAddClient(c);
    110 }
    111 
    112 void CachedImage::didRemoveClient(CachedResourceClient* c)
    113 {
    114     ASSERT(c->resourceClientType() == CachedImageClient::expectedType());
    115 #if ENABLE(SVG)
    116     if (m_svgImageCache)
    117         m_svgImageCache->removeClientFromCache(static_cast<CachedImageClient*>(c));
    118 #endif
    119 
    120     CachedResource::didRemoveClient(c);
    121119}
    122120
    … …  
    127125    if (double interval = memoryCache()->deadDecodedDataDeletionInterval())
    128126        m_decodedDataDeletionTimer.startOneShot(interval);
    129     CachedResource::allClientsRemoved();
    130127}
    131128
    … …  
    153150    if (!m_image->isSVGImage())
    154151        return m_image.get();
    155     Image* useImage = m_svgImageCache->lookupOrCreateBitmapImageForClient(renderer);
     152    Image* useImage = m_svgImageCache->lookupOrCreateBitmapImageForRenderer(renderer);
    156153    if (useImage == Image::nullImage())
    157154        return m_image.get();

  • trunk/Source/WebCore/loader/cache/CachedImage.h

    r119353 r119918  
    6868    void computeIntrinsicDimensions(Length& intrinsicWidth, Length& intrinsicHeight, FloatSize& intrinsicRatio);
    6969
     70    void removeClientForRenderer(RenderObject*);
    7071    virtual void didAddClient(CachedResourceClient*);
    71     virtual void didRemoveClient(CachedResourceClient*);
    72 
     72   
    7373    virtual void allClientsRemoved();
    7474    virtual void destroyDecodedData();
    … …  
    119119    virtual ~CachedImageClient() { }
    120120    static CachedResourceClientType expectedType() { return ImageType; }
    121     virtual CachedResourceClientType resourceClientType() const { return expectedType(); }
     121    virtual CachedResourceClientType resourceClientType() { return expectedType(); }
    122122
    123123    // Called whenever a frame of an image changes, either because we got more data from the network or

  • trunk/Source/WebCore/loader/cache/CachedRawResource.cpp

    r118618 r119918  
    8888}
    8989
     90void CachedRawResource::allClientsRemoved()
     91{
     92    if (m_loader)
     93        m_loader->cancelIfNotFinishing();
     94}
     95
    9096void CachedRawResource::willSendRequest(ResourceRequest& request, const ResourceResponse& response)
    9197{

  • trunk/Source/WebCore/loader/cache/CachedRawResource.h

    r119353 r119918  
    5050
    5151    virtual bool shouldIgnoreHTTPStatusCodeErrors() const { return true; }
     52    virtual void allClientsRemoved();
    5253
    5354    virtual void willSendRequest(ResourceRequest&, const ResourceResponse&);
    … …  
    6667    virtual ~CachedRawResourceClient() { }
    6768    static CachedResourceClientType expectedType() { return RawResourceType; }
    68     virtual CachedResourceClientType resourceClientType() const { return expectedType(); }
     69    virtual CachedResourceClientType resourceClientType() { return expectedType(); }
    6970
    7071    virtual void dataSent(CachedResource*, unsigned long long /* bytesSent */, unsigned long long /* totalBytesToBeSent */) { }

  • trunk/Source/WebCore/loader/cache/CachedResource.cpp

    r119353 r119918  
    388388}
    389389
    390 void CachedResource::allClientsRemoved()
    391 {
    392     if (m_loader)
    393         m_loader->cancelIfNotFinishing();
    394 }
    395 
    396390bool CachedResource::addClientToSet(CachedResourceClient* client)
    397391{
    … …  
    433427        ASSERT(m_clients.contains(client));
    434428        m_clients.remove(client);
    435         didRemoveClient(client);
    436429    }
    437430

  • trunk/Source/WebCore/loader/cache/CachedResource.h

    r119353 r119918  
    127127
    128128    virtual void didAddClient(CachedResourceClient*);
    129     virtual void didRemoveClient(CachedResourceClient*) { }
    130     virtual void allClientsRemoved();
     129    virtual void allClientsRemoved() { }
    131130
    132131    unsigned count() const { return m_clients.size(); }

  • trunk/Source/WebCore/loader/cache/CachedResourceClient.h

    r119353 r119918  
    5151   
    5252    static CachedResourceClientType expectedType() { return BaseResourceType; }
    53     virtual CachedResourceClientType resourceClientType() const { return expectedType(); }
     53    virtual CachedResourceClientType resourceClientType() { return expectedType(); }
    5454
    5555protected:

  • trunk/Source/WebCore/loader/cache/CachedSVGDocument.h

    r119353 r119918  
    5353    virtual ~CachedSVGDocumentClient() { }
    5454    static CachedResourceClientType expectedType() { return SVGDocumentType; }
    55     virtual CachedResourceClientType resourceClientType() const { return expectedType(); }
     55    virtual CachedResourceClientType resourceClientType() { return expectedType(); }
    5656};
    5757

  • trunk/Source/WebCore/loader/cache/CachedScript.cpp

    r118618 r119918  
    6868    if (double interval = memoryCache()->deadDecodedDataDeletionInterval())
    6969        m_decodedDataDeletionTimer.startOneShot(interval);
    70     CachedResource::allClientsRemoved();
    7170}
    7271

  • trunk/Source/WebCore/loader/cache/CachedStyleSheetClient.h

    r119353 r119918  
    3737    virtual ~CachedStyleSheetClient() { }
    3838    static CachedResourceClientType expectedType() { return StyleSheetType; }
    39     virtual CachedResourceClientType resourceClientType() const { return expectedType(); }
     39    virtual CachedResourceClientType resourceClientType() { return expectedType(); }
    4040    virtual void setCSSStyleSheet(const String& /* href */, const KURL& /* baseURL */, const String& /* charset */, const CachedCSSStyleSheet*) { }
    4141    virtual void setXSLStyleSheet(const String& /* href */, const KURL& /* baseURL */, const String& /* sheet */) { }

  • trunk/Source/WebCore/rendering/style/StyleCachedImage.cpp

    r119353 r119918  
    9898void StyleCachedImage::removeClient(RenderObject* renderer)
    9999{
    100     m_image->removeClient(renderer);
     100    m_image->removeClientForRenderer(renderer);
    101101}
    102102

  • trunk/Source/WebCore/rendering/style/StyleCachedImageSet.cpp

    r119353 r119918  
    109109void StyleCachedImageSet::removeClient(RenderObject* renderer)
    110110{
    111     m_bestFitImage->removeClient(renderer);
     111    m_bestFitImage->removeClientForRenderer(renderer);
    112112}
    113113

  • trunk/Source/WebCore/svg/graphics/SVGImageCache.cpp

    r119353 r119918  
    2222
    2323#if ENABLE(SVG)
    24 #include "CachedImage.h"
    2524#include "FrameView.h"
    2625#include "GraphicsContext.h"
    … …  
    4342
    4443    ImageDataMap::iterator end = m_imageDataMap.end();
    45     for (ImageDataMap::iterator it = m_imageDataMap.begin(); it != end; ++it) {
    46         // Checks if the client (it->first) is still valid. The client should remove itself from this
    47         // cache before its end of life, otherwise the following ASSERT will crash on pure virtual
    48         // function call or a general crash.
    49         ASSERT(it->first->resourceClientType() == CachedImageClient::expectedType());
     44    for (ImageDataMap::iterator it = m_imageDataMap.begin(); it != end; ++it)
    5045        delete it->second.buffer;
    51     }
    5246
    5347    m_imageDataMap.clear();
    5448}
    5549
    56 void SVGImageCache::removeClientFromCache(const CachedImageClient* client)
     50void SVGImageCache::removeRendererFromCache(const RenderObject* renderer)
    5751{
    58     ASSERT(client);
    59     m_sizeAndScalesMap.remove(client);
     52    ASSERT(renderer);
     53    m_sizeAndScalesMap.remove(renderer);
    6054
    61     ImageDataMap::iterator it = m_imageDataMap.find(client);
     55    ImageDataMap::iterator it = m_imageDataMap.find(renderer);
    6256    if (it == m_imageDataMap.end())
    6357        return;
    … …  
    6761}
    6862
    69 void SVGImageCache::setRequestedSizeAndScales(const CachedImageClient* client, const SizeAndScales& sizeAndScales)
     63void SVGImageCache::setRequestedSizeAndScales(const RenderObject* renderer, const SizeAndScales& sizeAndScales)
    7064{
    71     ASSERT(client);
     65    ASSERT(renderer);
    7266    ASSERT(!sizeAndScales.size.isEmpty());
    73     m_sizeAndScalesMap.set(client, sizeAndScales);
     67    m_sizeAndScalesMap.set(renderer, sizeAndScales);
    7468}
    7569
    76 SVGImageCache::SizeAndScales SVGImageCache::requestedSizeAndScales(const CachedImageClient* client) const
     70SVGImageCache::SizeAndScales SVGImageCache::requestedSizeAndScales(const RenderObject* renderer) const
    7771{
    78     ASSERT(client);
    79     SizeAndScalesMap::const_iterator it = m_sizeAndScalesMap.find(client);
     72    ASSERT(renderer);
     73    SizeAndScalesMap::const_iterator it = m_sizeAndScalesMap.find(renderer);
    8074    if (it == m_sizeAndScalesMap.end())
    8175        return SizeAndScales();
    … …  
    129123}
    130124
    131 Image* SVGImageCache::lookupOrCreateBitmapImageForClient(const CachedImageClient* client)
     125Image* SVGImageCache::lookupOrCreateBitmapImageForRenderer(const RenderObject* renderer)
    132126{
    133     ASSERT(client);
     127    ASSERT(renderer);
    134128
    135     // The cache needs to know the size of the client before querying an image for it.
    136     SizeAndScalesMap::iterator sizeIt = m_sizeAndScalesMap.find(client);
     129    // The cache needs to know the size of the renderer before querying an image for it.
     130    SizeAndScalesMap::iterator sizeIt = m_sizeAndScalesMap.find(renderer);
    137131    if (sizeIt == m_sizeAndScalesMap.end())
    138132        return Image::nullImage();
    … …  
    143137    ASSERT(!size.isEmpty());
    144138
    145     // Lookup image for client in cache and eventually update it.
    146     ImageDataMap::iterator it = m_imageDataMap.find(client);
     139    // Lookup image for renderer in cache and eventually update it.
     140    ImageDataMap::iterator it = m_imageDataMap.find(renderer);
    147141    if (it != m_imageDataMap.end()) {
    148142        ImageData& data = it->second;
    … …  
    152146            return data.image.get();
    153147
    154         // If the image size for the client changed, we have to delete the buffer, remove the item from the cache and recreate it.
     148        // If the image size for the renderer changed, we have to delete the buffer, remove the item from the cache and recreate it.
    155149        delete data.buffer;
    156150        m_imageDataMap.remove(it);
    … …  
    171165    ASSERT(newImagePtr);
    172166
    173     m_imageDataMap.add(client, ImageData(newBuffer.leakPtr(), newImage.release(), sizeIt->second));
     167    m_imageDataMap.add(renderer, ImageData(newBuffer.leakPtr(), newImage.release(), sizeIt->second));
    174168    return newImagePtr;
    175169}

  • trunk/Source/WebCore/svg/graphics/SVGImageCache.h

    r119353 r119918  
    3232
    3333class CachedImage;
    34 class CachedImageClient;
    3534class ImageBuffer;
     35class RenderObject;
    3636class SVGImage;
    3737
    … …  
    6464    };
    6565
    66     void removeClientFromCache(const CachedImageClient*);
     66    void removeRendererFromCache(const RenderObject*);
    6767
    68     void setRequestedSizeAndScales(const CachedImageClient*, const SizeAndScales&);
    69     SizeAndScales requestedSizeAndScales(const CachedImageClient*) const;
     68    void setRequestedSizeAndScales(const RenderObject*, const SizeAndScales&);
     69    SizeAndScales requestedSizeAndScales(const RenderObject*) const;
    7070
    71     Image* lookupOrCreateBitmapImageForClient(const CachedImageClient*);
     71    Image* lookupOrCreateBitmapImageForRenderer(const RenderObject*);
    7272    void imageContentChanged();
    7373
    … …  
    9999    };
    100100
    101     typedef HashMap<const CachedImageClient*, SizeAndScales> SizeAndScalesMap;
    102     typedef HashMap<const CachedImageClient*, ImageData> ImageDataMap;
     101    typedef HashMap<const RenderObject*, SizeAndScales> SizeAndScalesMap;
     102    typedef HashMap<const RenderObject*, ImageData> ImageDataMap;
    103103
    104104    SVGImage* m_svgImage;
Note: See TracChangeset for help on using the changeset viewer.