Changeset 169866 in webkit

Timestamp:

Jun 11, 2014 5:30:22 PM (10 years ago)

Author:

ap@apple.com

Message:

editing/selection/selection-in-iframe-removed-crash.html or selection-invalid-offset.html crashes intermittently
​https://bugs.webkit.org/show_bug.cgi?id=111521
<rdar://problem/15159351>

Reviewed by Brady Eidson.

Source/WebCore:
Covered by existing tests.

• loader/DocumentLoader.cpp: (WebCore::DocumentLoader::commitData): Bail out if the

load was canceled from under receivedFirstData(). Since this is where we commit the
load, there are ample opportunities for scripts or clients to do anything.

LayoutTests:

• platform/mac/TestExpectations: Removed expectations for the tests.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/platform/mac/TestExpectations (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/loader/DocumentLoader.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2014-06-11  Alexey Proskuryakov  <ap@apple.com>
+
+        editing/selection/selection-in-iframe-removed-crash.html or selection-invalid-offset.html crashes intermittently
+        https://bugs.webkit.org/show_bug.cgi?id=111521
+        <rdar://problem/15159351>
+
+        Reviewed by Brady Eidson.
+
+        * platform/mac/TestExpectations: Removed expectations for the tests.
+
 2014-06-11  Zalan Bujtas  <zalan@apple.com>
 

trunk/LayoutTests/platform/mac/TestExpectations

@@ -989 +989 @@
 # Need support for ResourceHandle::didChangePriority and DRT support
 webkit.org/b/111016 http/tests/loading/promote-img-preload-priority.html [ Failure ]
-
-webkit.org/b/111521 editing/selection/selection-invalid-offset.html [ Crash Pass ]
-webkit.org/b/111521 editing/selection/selection-in-iframe-removed-crash.html [ Crash Pass ]
 
 webkit.org/b/110546 [ Debug ] fast/parser/document-write-fighting-eof.html [ Skip ]

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-06-11  Alexey Proskuryakov  <ap@apple.com>
+
+        editing/selection/selection-in-iframe-removed-crash.html or selection-invalid-offset.html crashes intermittently
+        https://bugs.webkit.org/show_bug.cgi?id=111521
+        <rdar://problem/15159351>
+
+        Reviewed by Brady Eidson.
+
+        Covered by existing tests.
+
+        * loader/DocumentLoader.cpp: (WebCore::DocumentLoader::commitData): Bail out if the
+        load was canceled from under receivedFirstData(). Since this is where we commit the
+        load, there are ample opportunities for scripts or clients to do anything.
+
 2014-06-11  Zalan Bujtas  <zalan@apple.com>
 

trunk/Source/WebCore/loader/DocumentLoader.cpp

@@ -813 +813 @@
             frameLoader()->receivedFirstData();
 
+        // The load could be canceled under receivedFirstData(), which makes delegate calls and even sometimes dispatches DOM events.
+        if (!isLoading())
+            return;
+
         bool userChosen;
         String encoding;