Changeset 139876 in webkit


Ignore:
Timestamp:
Jan 16, 2013 5:55:49 AM (11 years ago)
Author:
jocelyn.turcotte@digia.com
Message:

[Qt] Crash in WebCore::CachedFrame::destroy
​https://bugs.webkit.org/show_bug.cgi?id=104525

Reviewed by Adam Barth.

Source/WebCore:

Add an assert to increase the chances of catching this crash
early on in the future.

  • dom/Document.cpp:

(WebCore::Document::takeDOMWindowFrom):

Source/WebKit/qt:

Remove the call to HistoryController::setCurrentItem which is ultimately
causing the initial empty document of a page to be added to the page cache.

This re-introduce the bug that was fixed by this line, which will be
properly fixed in a follow-up patch.

  • Api/qwebhistory.cpp:

(operator>>):

  • tests/qwebhistory/tst_qwebhistory.cpp:

(tst_QWebHistory::saveAndRestore_crash_4): Cover the crash.

Location:
trunk/Source
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebCore/ChangeLog

    r139873 r139876  
     12013-01-16  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
     2
     3        [Qt] Crash in WebCore::CachedFrame::destroy
     4        https://bugs.webkit.org/show_bug.cgi?id=104525
     5
     6        Reviewed by Adam Barth.
     7
     8        Add an assert to increase the chances of catching this crash
     9        early on in the future.
     10
     11        * dom/Document.cpp:
     12        (WebCore::Document::takeDOMWindowFrom):
     13
    1142013-01-16  Andrey Lushnikov  <lushnikov@chromium.org>
    215

  • trunk/Source/WebCore/dom/Document.cpp

    r139780 r139876  
    36043604    ASSERT(!m_domWindow);
    36053605    ASSERT(document->domWindow());
     3606    // A valid DOMWindow is needed by CachedFrame for its documents.
     3607    ASSERT(!document->inPageCache());
    36063608
    36073609    m_domWindow = document->m_domWindow.release();

  • trunk/Source/WebKit/qt/Api/qwebhistory.cpp

    r135515 r139876  
    543543            }
    544544            d->lst->removeItem(nullItem);
    545             // Update the HistoryController.
    546             static_cast<WebCore::BackForwardListImpl*>(history.d->lst)->page()->mainFrame()->loader()->history()->setCurrentItem(history.d->lst->entries()[currentIndex].get());
    547545            history.goToItem(history.itemAt(currentIndex));
    548546        }

  • trunk/Source/WebKit/qt/ChangeLog

    r139526 r139876  
     12013-01-16  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
     2
     3        [Qt] Crash in WebCore::CachedFrame::destroy
     4        https://bugs.webkit.org/show_bug.cgi?id=104525
     5
     6        Reviewed by Adam Barth.
     7
     8        Remove the call to HistoryController::setCurrentItem which is ultimately
     9        causing the initial empty document of a page to be added to the page cache.
     10
     11        This re-introduce the bug that was fixed by this line, which will be
     12        properly fixed in a follow-up patch.
     13
     14        * Api/qwebhistory.cpp:
     15        (operator>>):
     16        * tests/qwebhistory/tst_qwebhistory.cpp:
     17        (tst_QWebHistory::saveAndRestore_crash_4): Cover the crash.
     18
    1192013-01-11  Huang Dongsung  <luxtella@company100.net>
    220

  • trunk/Source/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp

    r125603 r139876  
    5757    void serialize_2(); //QWebHistory index
    5858    void serialize_3(); //QWebHistoryItem
     59    // Those tests shouldn't crash
    5960    void saveAndRestore_crash_1();
    6061    void saveAndRestore_crash_2();
    6162    void saveAndRestore_crash_3();
     63    void saveAndRestore_crash_4();
     64
    6265    void popPushState_data();
    6366    void popPushState();
    … …  
    309312}
    310313
    311 /** The test shouldn't crash */
    312314void tst_QWebHistory::saveAndRestore_crash_1()
    313315{
    … …  
    320322}
    321323
    322 /** The test shouldn't crash */
    323324void tst_QWebHistory::saveAndRestore_crash_2()
    324325{
    … …  
    334335}
    335336
    336 /** The test shouldn't crash */
    337337void tst_QWebHistory::saveAndRestore_crash_3()
    338338{
    … …  
    354354}
    355355
     356void tst_QWebHistory::saveAndRestore_crash_4()
     357{
     358    QByteArray buffer;
     359    saveHistory(hist, &buffer);
     360
     361    QWebPage* page2 = new QWebPage(this);
     362    // The initial crash was in PageCache.
     363    page2->settings()->setMaximumPagesInCache(3);
     364
     365    // Load the history in a new page, waiting for the load to finish.
     366    QEventLoop waitForLoadFinished;
     367    QObject::connect(page2, SIGNAL(loadFinished(bool)), &waitForLoadFinished, SLOT(quit()), Qt::QueuedConnection);
     368    QDataStream load(&buffer, QIODevice::ReadOnly);
     369    load >> *page2->history();
     370    waitForLoadFinished.exec();
     371
     372    delete page2;
     373    // Give some time for the PageCache cleanup 0-timer to fire.
     374    QTest::qWait(50);
     375}
     376
    356377void tst_QWebHistory::popPushState_data()
    357378{
Note: See TracChangeset for help on using the changeset viewer.