Changeset 232147 in webkit


Ignore:
Timestamp:
May 23, 2018 10:23:00 PM (6 years ago)
Author:
Brent Fulgham
Message:

Avoid keeping FormState alive longer than necessary
​https://bugs.webkit.org/show_bug.cgi?id=185877
<rdar://problem/39329219>

Reviewed by Ryosuke Niwa.

A number of crash fixes were done to prevent FormState objects from being
accessed after their relevant Frames had been destroyed. Unfortunately, this
could cause the FormState to persist after the owning Frame had been
destroyed, resulting in nullptr dereferences.

This patch does the following:

  1. Uses WeakPtr's for FormState objects passed to completion handlers, rather than RefPtr, since those completion handlers might fire as part of the clean-up process during Frame destruction. This allows us to use the FormState if they are still valid, but gracefully handle cases where a form submission is cancelled in-flight.
  2. Moves FormState object as they pass through the loader.
  3. Removes some extraneous WTFMove() calls being made on bare FormState pointers.
  4. Changes FormSubmission to hold a RefPtr so we can move the FormState to the loader in the code path that uses it (the FormSubmission is always destroyed shortly afterwards).
  5. Changes the trap from Bug 183704 so that it only fires if the FormState object is being retained more than once.
  • loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::willSendRequest): Update for new CompletionHandler
signature.

  • loader/FormState.cpp:

(WebCore::FormState::willDetachPage): Revise trap to check for retain counts
above one.

  • loader/FormState.h:

(WebCore::FormState::weakPtrFactory const): Added.

  • loader/FormSubmission.h:

(WebCore::FormSubmission::state const): Revised for change to RefPtr.
(WebCore::FormSubmission::takeState): Added.

  • loader/FrameLoader.cpp:

(WebCore::FrameLoader::urlSelected): Update for new CompletionHandler signature.
(WebCore::FrameLoader::loadURLIntoChildFrame): Ditto.
(WebCore::FrameLoader::loadFrameRequest): Ditto.
(WebCore::FrameLoader::loadURL): Ditto.
(WebCore::FrameLoader::load): Ditto.
(WebCore::FrameLoader::loadWithNavigationAction): Ditto.
(WebCore::FrameLoader::loadWithDocumentLoader): Ditto.
(WebCore::FrameLoader::reloadWithOverrideEncoding): Ditto.
(WebCore::FrameLoader::reload): Ditto.
(WebCore::FrameLoader::loadPostRequest): Ditto.
(WebCore::FrameLoader::loadDifferentDocumentItem): Ditto.

  • loader/FrameLoader.h:
  • loader/NavigationScheduler.cpp:
  • loader/PolicyChecker.cpp:

(WebCore::PolicyChecker::checkNavigationPolicy):Revise to use WeakPtr for
FormState passed to the completion handler. Remove some extraneous WTFMove()
calls on bare pointers.
(WebCore::PolicyChecker::checkNewWindowPolicy): Ditto.

  • loader/PolicyChecker.h:
  • page/ContextMenuController.cpp:

(WebCore::openNewWindow): Revise for new signatures.
(WebCore::ContextMenuController::contextMenuItemSelected): Ditto.

Location:
trunk/Source/WebCore
Files:
11 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebCore/ChangeLog

    r232143 r232147  
     12018-05-23  Brent Fulgham  <bfulgham@apple.com>
     2
     3        Avoid keeping FormState alive longer than necessary
     4        https://bugs.webkit.org/show_bug.cgi?id=185877
     5        <rdar://problem/39329219>
     6
     7        Reviewed by Ryosuke Niwa.
     8
     9        A number of crash fixes were done to prevent FormState objects from being
     10        accessed after their relevant Frames had been destroyed. Unfortunately, this
     11        could cause the FormState to persist after the owning Frame had been
     12        destroyed, resulting in nullptr dereferences.
     13
     14        This patch does the following:
     15
     16        1. Uses WeakPtr's for FormState objects passed to completion handlers, rather
     17           than RefPtr, since those completion handlers might fire as part of the
     18           clean-up process during Frame destruction. This allows us to use the FormState
     19           if they are still valid, but gracefully handle cases where a form submission
     20           is cancelled in-flight.
     21        2. Moves FormState object as they pass through the loader.
     22        3. Removes some extraneous WTFMove() calls being made on bare FormState pointers.
     23        4. Changes FormSubmission to hold a RefPtr so we can move the FormState to the
     24           loader in the code path that uses it (the FormSubmission is always destroyed
     25           shortly afterwards).
     26        5. Changes the trap from Bug 183704 so that it only fires if the FormState object
     27           is being retained more than once.
     28
     29        * loader/DocumentLoader.cpp:
     30        (WebCore::DocumentLoader::willSendRequest): Update for new CompletionHandler
     31        signature.
     32        * loader/FormState.cpp:
     33        (WebCore::FormState::willDetachPage): Revise trap to check for retain counts
     34        above one.
     35        * loader/FormState.h:
     36        (WebCore::FormState::weakPtrFactory const): Added.
     37        * loader/FormSubmission.h:
     38        (WebCore::FormSubmission::state const): Revised for change to RefPtr.
     39        (WebCore::FormSubmission::takeState): Added.
     40        * loader/FrameLoader.cpp:
     41        (WebCore::FrameLoader::urlSelected): Update for new CompletionHandler signature.
     42        (WebCore::FrameLoader::loadURLIntoChildFrame): Ditto.
     43        (WebCore::FrameLoader::loadFrameRequest): Ditto.
     44        (WebCore::FrameLoader::loadURL): Ditto.
     45        (WebCore::FrameLoader::load): Ditto.
     46        (WebCore::FrameLoader::loadWithNavigationAction): Ditto.
     47        (WebCore::FrameLoader::loadWithDocumentLoader): Ditto.
     48        (WebCore::FrameLoader::reloadWithOverrideEncoding): Ditto.
     49        (WebCore::FrameLoader::reload): Ditto.
     50        (WebCore::FrameLoader::loadPostRequest): Ditto.
     51        (WebCore::FrameLoader::loadDifferentDocumentItem): Ditto.
     52        * loader/FrameLoader.h:
     53        * loader/NavigationScheduler.cpp:
     54        * loader/PolicyChecker.cpp:
     55        (WebCore::PolicyChecker::checkNavigationPolicy):Revise to use WeakPtr for
     56        FormState passed to the completion handler. Remove some extraneous WTFMove()
     57        calls on bare pointers.
     58        (WebCore::PolicyChecker::checkNewWindowPolicy): Ditto.
     59        * loader/PolicyChecker.h:
     60        * page/ContextMenuController.cpp:
     61        (WebCore::openNewWindow): Revise for new signatures.
     62        (WebCore::ContextMenuController::contextMenuItemSelected): Ditto.
     63
    1642018-05-23  Keith Miller  <keith_miller@apple.com>
    265

  • trunk/Source/WebCore/loader/DocumentLoader.cpp

    r232093 r232147  
    11/*
    2  * Copyright (C) 2006-2017 Apple Inc. All rights reserved.
     2 * Copyright (C) 2006-2018 Apple Inc. All rights reserved.
    33 * Copyright (C) 2011 Google Inc. All rights reserved.
    44 *
    … …  
    641641        return completionHandler(WTFMove(newRequest));
    642642
    643     auto navigationPolicyCompletionHandler = [this, protectedThis = makeRef(*this), completionHandler = WTFMove(completionHandler)] (ResourceRequest&& request, FormState*, ShouldContinue shouldContinue) mutable {
     643    auto navigationPolicyCompletionHandler = [this, protectedThis = makeRef(*this), completionHandler = WTFMove(completionHandler)] (ResourceRequest&& request, WeakPtr<FormState>&&, ShouldContinue shouldContinue) mutable {
    644644        m_waitingForNavigationPolicy = false;
    645645        switch (shouldContinue) {

  • trunk/Source/WebCore/loader/FormState.cpp

    r232093 r232147  
    11/*
    2  * Copyright (C) 2006-2017 Apple Inc. All rights reserved.
     2 * Copyright (C) 2006-2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    5353{
    5454    // Beartrap for <rdar://problem/37579354>
    55     RELEASE_ASSERT_NOT_REACHED();
     55    RELEASE_ASSERT(hasOneRef());
    5656}
    5757

  • trunk/Source/WebCore/loader/FormState.h

    r232093 r232147  
    11/*
    2  * Copyright (C) 2006-2017 Apple Inc. All rights reserved.
     2 * Copyright (C) 2006-2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    3030
    3131#include "FrameDestructionObserver.h"
     32#include <wtf/WeakPtr.h>
    3233#include <wtf/text/WTFString.h>
    3334
    … …  
    5051    FormSubmissionTrigger formSubmissionTrigger() const { return m_formSubmissionTrigger; }
    5152
     53    auto& weakPtrFactory() const { return m_weakFactory; }
     54
    5255private:
    5356    FormState(HTMLFormElement&, StringPairVector&& textFieldValues, Document&, FormSubmissionTrigger);
    … …  
    5861    Ref<Document> m_sourceDocument;
    5962    FormSubmissionTrigger m_formSubmissionTrigger;
     63    WeakPtrFactory<FormState> m_weakFactory;
    6064};
    6165

  • trunk/Source/WebCore/loader/FormSubmission.h

    r218665 r232147  
    8484    const String& target() const { return m_target; }
    8585    const String& contentType() const { return m_contentType; }
    86     FormState& state() const { return m_formState; }
     86    FormState& state() const { return *m_formState; }
     87    Ref<FormState> takeState() { return m_formState.releaseNonNull(); }
    8788    FormData& data() const { return m_formData; }
    8889    const String boundary() const { return m_boundary; }
    … …  
    104105    String m_target;
    105106    String m_contentType;
    106     Ref<FormState> m_formState;
     107    RefPtr<FormState> m_formState;
    107108    Ref<FormData> m_formData;
    108109    String m_boundary;

  • trunk/Source/WebCore/loader/FrameLoader.cpp

    r232123 r232147  
    11/*
    2  * Copyright (C) 2006-2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2006-2018 Apple Inc. All rights reserved.
    33 * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
    44 * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
    … …  
    393393    m_frame.document()->contentSecurityPolicy()->upgradeInsecureRequestIfNeeded(frameRequest.resourceRequest(), ContentSecurityPolicy::InsecureRequestType::Navigation);
    394394
    395     loadFrameRequest(WTFMove(frameRequest), triggeringEvent, nullptr);
     395    loadFrameRequest(WTFMove(frameRequest), triggeringEvent, { });
    396396}
    397397
    … …  
    958958
    959959    FrameLoadRequest frameLoadRequest { *m_frame.document(), m_frame.document()->securityOrigin(), { url }, ASCIILiteral("_self"), LockHistory::No, LockBackForwardList::Yes, ShouldSendReferrer::MaybeSendReferrer, AllowNavigationToInvalidURL::Yes, NewFrameOpenerPolicy::Suppress, ShouldOpenExternalURLsPolicy::ShouldNotAllow, initiatedByMainFrame };
    960     childFrame->loader().loadURL(WTFMove(frameLoadRequest), referer, FrameLoadType::RedirectWithLockedBackForwardList, nullptr, nullptr, [] { });
     960    childFrame->loader().loadURL(WTFMove(frameLoadRequest), referer, FrameLoadType::RedirectWithLockedBackForwardList, nullptr, { }, [] { });
    961961}
    962962
    … …  
    12001200}
    12011201
    1202 void FrameLoader::loadFrameRequest(FrameLoadRequest&& request, Event* event, FormState* formState)
     1202void FrameLoader::loadFrameRequest(FrameLoadRequest&& request, Event* event, RefPtr<FormState>&& formState)
    12031203{
    12041204    // Protect frame from getting blown away inside dispatchBeforeLoadEvent in loadWithDocumentLoader.
    … …  
    12291229        loadType = FrameLoadType::Standard;
    12301230
    1231     auto completionHandler = [this, protectedFrame = makeRef(m_frame), formState = makeRefPtr(formState), frameName = request.frameName()] {
     1231    auto completionHandler = [this, protectedFrame = makeRef(m_frame), formState = makeWeakPtr(formState.get()), frameName = request.frameName()] {
    12321232        // FIXME: It's possible this targetFrame will not be the same frame that was targeted by the actual
    12331233        // load if frame names have changed.
    … …  
    12431243
    12441244    if (request.resourceRequest().httpMethod() == "POST")
    1245         loadPostRequest(WTFMove(request), referrer, loadType, event, formState, WTFMove(completionHandler));
     1245        loadPostRequest(WTFMove(request), referrer, loadType, event, WTFMove(formState), WTFMove(completionHandler));
    12461246    else
    1247         loadURL(WTFMove(request), referrer, loadType, event, formState, WTFMove(completionHandler));
     1247        loadURL(WTFMove(request), referrer, loadType, event, WTFMove(formState), WTFMove(completionHandler));
    12481248}
    12491249
    … …  
    12871287}
    12881288
    1289 void FrameLoader::loadURL(FrameLoadRequest&& frameLoadRequest, const String& referrer, FrameLoadType newLoadType, Event* event, FormState* formState, CompletionHandler<void()>&& completionHandler)
     1289void FrameLoader::loadURL(FrameLoadRequest&& frameLoadRequest, const String& referrer, FrameLoadType newLoadType, Event* event, RefPtr<FormState>&& formState, CompletionHandler<void()>&& completionHandler)
    12901290{
    12911291    CompletionHandlerCallingScope completionHandlerCaller(WTFMove(completionHandler));
    … …  
    13211321    if (targetFrame && targetFrame != &m_frame) {
    13221322        frameLoadRequest.setFrameName("_self");
    1323         targetFrame->loader().loadURL(WTFMove(frameLoadRequest), referrer, newLoadType, event, formState, completionHandlerCaller.release());
     1323        targetFrame->loader().loadURL(WTFMove(frameLoadRequest), referrer, newLoadType, event, WTFMove(formState), completionHandlerCaller.release());
    13241324        return;
    13251325    }
    … …  
    13391339    if (!targetFrame && !frameName.isEmpty()) {
    13401340        action = action.copyWithShouldOpenExternalURLsPolicy(shouldOpenExternalURLsPolicyToApply(m_frame, frameLoadRequest));
    1341         policyChecker().checkNewWindowPolicy(WTFMove(action), WTFMove(request), formState, frameName, [this, allowNavigationToInvalidURL, openerPolicy, completionHandler = completionHandlerCaller.release()] (const ResourceRequest& request, FormState* formState, const String& frameName, const NavigationAction& action, ShouldContinue shouldContinue) {
    1342             continueLoadAfterNewWindowPolicy(request, formState, frameName, action, shouldContinue, allowNavigationToInvalidURL, openerPolicy);
     1341        policyChecker().checkNewWindowPolicy(WTFMove(action), WTFMove(request), WTFMove(formState), frameName, [this, allowNavigationToInvalidURL, openerPolicy, completionHandler = completionHandlerCaller.release()] (const ResourceRequest& request, WeakPtr<FormState>&& formState, const String& frameName, const NavigationAction& action, ShouldContinue shouldContinue) {
     1342            continueLoadAfterNewWindowPolicy(request, formState.get(), frameName, action, shouldContinue, allowNavigationToInvalidURL, openerPolicy);
    13431343            completionHandler();
    13441344        });
    … …  
    13591359        policyChecker().stopCheck();
    13601360        policyChecker().setLoadType(newLoadType);
    1361         policyChecker().checkNavigationPolicy(WTFMove(request), false /* didReceiveRedirectResponse */, oldDocumentLoader.get(), formState, [this, protectedFrame = makeRef(m_frame)] (const ResourceRequest& request, FormState*, ShouldContinue shouldContinue) {
     1361        policyChecker().checkNavigationPolicy(WTFMove(request), false /* didReceiveRedirectResponse */, oldDocumentLoader.get(), WTFMove(formState), [this, protectedFrame = makeRef(m_frame)] (const ResourceRequest& request, WeakPtr<FormState>&&, ShouldContinue shouldContinue) {
    13621362            continueFragmentScrollAfterNavigationPolicy(request, shouldContinue == ShouldContinue::Yes);
    13631363        }, PolicyDecisionMode::Synchronous);
    … …  
    13731373        request.setSystemPreviewRect(frameLoadRequest.systemPreviewRect());
    13741374#endif
    1375     loadWithNavigationAction(request, action, lockHistory, newLoadType, formState, allowNavigationToInvalidURL, [this, isRedirect, sameURL, newLoadType, protectedFrame = makeRef(m_frame), completionHandler = completionHandlerCaller.release()] {
     1375    loadWithNavigationAction(request, action, lockHistory, newLoadType, WTFMove(formState), allowNavigationToInvalidURL, [this, isRedirect, sameURL, newLoadType, protectedFrame = makeRef(m_frame), completionHandler = completionHandlerCaller.release()] {
    13761376        if (isRedirect) {
    13771377            m_quickRedirectComing = false;
    … …  
    14201420    if (request.shouldCheckNewWindowPolicy()) {
    14211421        NavigationAction action { request.requester(), request.resourceRequest(), InitiatedByMainFrame::Unknown, NavigationType::Other, request.shouldOpenExternalURLsPolicy() };
    1422         policyChecker().checkNewWindowPolicy(WTFMove(action), WTFMove(request.resourceRequest()), nullptr, request.frameName(), [this] (const ResourceRequest& request, FormState* formState, const String& frameName, const NavigationAction& action, ShouldContinue shouldContinue) {
    1423             continueLoadAfterNewWindowPolicy(request, formState, frameName, action, shouldContinue, AllowNavigationToInvalidURL::Yes, NewFrameOpenerPolicy::Suppress);
     1422        policyChecker().checkNewWindowPolicy(WTFMove(action), WTFMove(request.resourceRequest()), { }, request.frameName(), [this] (const ResourceRequest& request, WeakPtr<FormState>&& formState, const String& frameName, const NavigationAction& action, ShouldContinue shouldContinue) {
     1423            continueLoadAfterNewWindowPolicy(request, formState.get(), frameName, action, shouldContinue, AllowNavigationToInvalidURL::Yes, NewFrameOpenerPolicy::Suppress);
    14241424        });
    14251425
    … …  
    14381438}
    14391439
    1440 void FrameLoader::loadWithNavigationAction(const ResourceRequest& request, const NavigationAction& action, LockHistory lockHistory, FrameLoadType type, FormState* formState, AllowNavigationToInvalidURL allowNavigationToInvalidURL, CompletionHandler<void()>&& completionHandler)
     1440void FrameLoader::loadWithNavigationAction(const ResourceRequest& request, const NavigationAction& action, LockHistory lockHistory, FrameLoadType type, RefPtr<FormState>&& formState, AllowNavigationToInvalidURL allowNavigationToInvalidURL, CompletionHandler<void()>&& completionHandler)
    14411441{
    14421442    Ref<DocumentLoader> loader = m_client.createDocumentLoader(request, defaultSubstituteDataForURL(request.url()));
    … …  
    14501450        loader->setOverrideEncoding(m_documentLoader->overrideEncoding());
    14511451
    1452     loadWithDocumentLoader(loader.ptr(), type, formState, allowNavigationToInvalidURL, NavigationPolicyCheck::Require, WTFMove(completionHandler));
     1452    loadWithDocumentLoader(loader.ptr(), type, WTFMove(formState), allowNavigationToInvalidURL, NavigationPolicyCheck::Require, WTFMove(completionHandler));
    14531453}
    14541454
    … …  
    14891489    }
    14901490
    1491     loadWithDocumentLoader(newDocumentLoader, type, 0, AllowNavigationToInvalidURL::Yes, NavigationPolicyCheck::Require, [] { });
    1492 }
    1493 
    1494 void FrameLoader::loadWithDocumentLoader(DocumentLoader* loader, FrameLoadType type, FormState* formState, AllowNavigationToInvalidURL allowNavigationToInvalidURL, NavigationPolicyCheck, CompletionHandler<void()>&& completionHandler)
     1491    loadWithDocumentLoader(newDocumentLoader, type, { }, AllowNavigationToInvalidURL::Yes, NavigationPolicyCheck::Require, [] { });
     1492}
     1493
     1494void FrameLoader::loadWithDocumentLoader(DocumentLoader* loader, FrameLoadType type, RefPtr<FormState>&& formState, AllowNavigationToInvalidURL allowNavigationToInvalidURL, NavigationPolicyCheck, CompletionHandler<void()>&& completionHandler)
    14951495{
    14961496    // Retain because dispatchBeforeLoadEvent may release the last reference to it.
    … …  
    15341534        oldDocumentLoader->setLastCheckedRequest(ResourceRequest());
    15351535        policyChecker().stopCheck();
    1536         policyChecker().checkNavigationPolicy(ResourceRequest(loader->request()), false /* didReceiveRedirectResponse */, oldDocumentLoader.get(), formState, [this, protectedFrame = makeRef(m_frame)] (const ResourceRequest& request, FormState*, ShouldContinue shouldContinue) {
     1536        policyChecker().checkNavigationPolicy(ResourceRequest(loader->request()), false /* didReceiveRedirectResponse */, oldDocumentLoader.get(), WTFMove(formState), [this, protectedFrame = makeRef(m_frame)] (const ResourceRequest& request, WeakPtr<FormState>&&, ShouldContinue shouldContinue) {
    15371537            continueFragmentScrollAfterNavigationPolicy(request, shouldContinue == ShouldContinue::Yes);
    15381538        }, PolicyDecisionMode::Synchronous);
    … …  
    15561556        if (!m_stateMachine.committedFirstRealDocumentLoad()
    15571557            && !ownerElement->dispatchBeforeLoadEvent(loader->request().url().string())) {
    1558             continueLoadAfterNavigationPolicy(loader->request(), formState, ShouldContinue::No, allowNavigationToInvalidURL);
     1558            continueLoadAfterNavigationPolicy(loader->request(), formState.get(), ShouldContinue::No, allowNavigationToInvalidURL);
    15591559            return;
    15601560        }
    … …  
    15641564
    15651565    if (!m_currentLoadShouldCheckNavigationPolicy) {
    1566         continueLoadAfterNavigationPolicy(loader->request(), formState, ShouldContinue::Yes, allowNavigationToInvalidURL);
    1567         return;
    1568     }
    1569 
    1570     policyChecker().checkNavigationPolicy(ResourceRequest(loader->request()), false /* didReceiveRedirectResponse */, loader, formState, [this, protectedFrame = makeRef(m_frame), allowNavigationToInvalidURL, completionHandler = completionHandlerCaller.release()] (const ResourceRequest& request, FormState* formState, ShouldContinue shouldContinue) {
    1571         continueLoadAfterNavigationPolicy(request, formState, shouldContinue, allowNavigationToInvalidURL);
     1566        continueLoadAfterNavigationPolicy(loader->request(), formState.get(), ShouldContinue::Yes, allowNavigationToInvalidURL);
     1567        return;
     1568    }
     1569
     1570    policyChecker().checkNavigationPolicy(ResourceRequest(loader->request()), false /* didReceiveRedirectResponse */, loader, WTFMove(formState), [this, protectedFrame = makeRef(m_frame), allowNavigationToInvalidURL, completionHandler = completionHandlerCaller.release()] (const ResourceRequest& request, WeakPtr<FormState>&& formState, ShouldContinue shouldContinue) {
     1571        continueLoadAfterNavigationPolicy(request, formState.get(), shouldContinue, allowNavigationToInvalidURL);
    15721572        completionHandler();
    15731573    });
    … …  
    16771677    loader->setOverrideEncoding(encoding);
    16781678
    1679     loadWithDocumentLoader(loader.ptr(), FrameLoadType::Reload, 0, AllowNavigationToInvalidURL::Yes, NavigationPolicyCheck::Require, [] { });
     1679    loadWithDocumentLoader(loader.ptr(), FrameLoadType::Reload, { }, AllowNavigationToInvalidURL::Yes, NavigationPolicyCheck::Require, [] { });
    16801680}
    16811681
    … …  
    17241724    };
    17251725   
    1726     loadWithDocumentLoader(loader.ptr(), frameLoadTypeForReloadOptions(options), 0, AllowNavigationToInvalidURL::Yes, NavigationPolicyCheck::Require, [] { });
     1726    loadWithDocumentLoader(loader.ptr(), frameLoadTypeForReloadOptions(options), { }, AllowNavigationToInvalidURL::Yes, NavigationPolicyCheck::Require, [] { });
    17271727}
    17281728
    … …  
    28332833}
    28342834
    2835 void FrameLoader::loadPostRequest(FrameLoadRequest&& request, const String& referrer, FrameLoadType loadType, Event* event, FormState* formState, CompletionHandler<void()>&& completionHandler)
     2835void FrameLoader::loadPostRequest(FrameLoadRequest&& request, const String& referrer, FrameLoadType loadType, Event* event, RefPtr<FormState>&& formState, CompletionHandler<void()>&& completionHandler)
    28362836{
    28372837    String frameName = request.frameName();
    … …  
    28622862    if (!frameName.isEmpty()) {
    28632863        // The search for a target frame is done earlier in the case of form submission.
    2864         if (Frame* targetFrame = formState ? 0 : findFrameForNavigation(frameName)) {
     2864        if (auto* targetFrame = formState ? nullptr : findFrameForNavigation(frameName)) {
    28652865            targetFrame->loader().loadWithNavigationAction(workingResourceRequest, action, lockHistory, loadType, WTFMove(formState), allowNavigationToInvalidURL, WTFMove(completionHandler));
    28662866            return;
    28672867        }
    28682868
    2869         policyChecker().checkNewWindowPolicy(WTFMove(action), WTFMove(workingResourceRequest), WTFMove(formState), frameName, [this, allowNavigationToInvalidURL, openerPolicy, completionHandler = WTFMove(completionHandler)] (const ResourceRequest& request, FormState* formState, const String& frameName, const NavigationAction& action, ShouldContinue shouldContinue) {
    2870             continueLoadAfterNewWindowPolicy(request, formState, frameName, action, shouldContinue, allowNavigationToInvalidURL, openerPolicy);
     2869        policyChecker().checkNewWindowPolicy(WTFMove(action), WTFMove(workingResourceRequest), WTFMove(formState), frameName, [this, allowNavigationToInvalidURL, openerPolicy, completionHandler = WTFMove(completionHandler)] (const ResourceRequest& request, WeakPtr<FormState>&& formState, const String& frameName, const NavigationAction& action, ShouldContinue shouldContinue) {
     2870            continueLoadAfterNewWindowPolicy(request, formState.get(), frameName, action, shouldContinue, allowNavigationToInvalidURL, openerPolicy);
    28712871            completionHandler();
    28722872        });
    … …  
    35343534
    35353535        documentLoader->setLastCheckedRequest(ResourceRequest());
    3536         loadWithDocumentLoader(documentLoader, loadType, 0, AllowNavigationToInvalidURL::Yes, navigationPolicyCheck, [] { });
     3536        loadWithDocumentLoader(documentLoader, loadType, { }, AllowNavigationToInvalidURL::Yes, navigationPolicyCheck, [] { });
    35373537        return;
    35383538    }
    … …  
    36223622    action.setTargetBackForwardItem(item);
    36233623
    3624     loadWithNavigationAction(request, action, LockHistory::No, loadType, 0, AllowNavigationToInvalidURL::Yes, [] { });
     3624    loadWithNavigationAction(request, action, LockHistory::No, loadType, { }, AllowNavigationToInvalidURL::Yes, [] { });
    36253625}
    36263626

  • trunk/Source/WebCore/loader/FrameLoader.h

    r232090 r232147  
    112112    // FIXME: These are all functions which start loads. We have too many.
    113113    WEBCORE_EXPORT void loadURLIntoChildFrame(const URL&, const String& referer, Frame*);
    114     WEBCORE_EXPORT void loadFrameRequest(FrameLoadRequest&&, Event*, FormState*); // Called by submitForm, calls loadPostRequest and loadURL.
     114    WEBCORE_EXPORT void loadFrameRequest(FrameLoadRequest&&, Event*, RefPtr<FormState>&&); // Called by submitForm, calls loadPostRequest and loadURL.
    115115
    116116    WEBCORE_EXPORT void load(FrameLoadRequest&&);
    … …  
    365365    void urlSelected(FrameLoadRequest&&, Event*);
    366366
    367     void loadWithDocumentLoader(DocumentLoader*, FrameLoadType, FormState*, AllowNavigationToInvalidURL, NavigationPolicyCheck, CompletionHandler<void()>&&); // Calls continueLoadAfterNavigationPolicy
     367    void loadWithDocumentLoader(DocumentLoader*, FrameLoadType, RefPtr<FormState>&&, AllowNavigationToInvalidURL, NavigationPolicyCheck, CompletionHandler<void()>&&); // Calls continueLoadAfterNavigationPolicy
    368368    void load(DocumentLoader*); // Calls loadWithDocumentLoader
    369369
    370     void loadWithNavigationAction(const ResourceRequest&, const NavigationAction&, LockHistory, FrameLoadType, FormState*, AllowNavigationToInvalidURL, CompletionHandler<void()>&&); // Calls loadWithDocumentLoader
    371 
    372     void loadPostRequest(FrameLoadRequest&&, const String& referrer, FrameLoadType, Event*, FormState*, CompletionHandler<void()>&&);
    373     void loadURL(FrameLoadRequest&&, const String& referrer, FrameLoadType, Event*, FormState*, CompletionHandler<void()>&&);
     370    void loadWithNavigationAction(const ResourceRequest&, const NavigationAction&, LockHistory, FrameLoadType, RefPtr<FormState>&&, AllowNavigationToInvalidURL, CompletionHandler<void()>&&); // Calls loadWithDocumentLoader
     371
     372    void loadPostRequest(FrameLoadRequest&&, const String& referrer, FrameLoadType, Event*, RefPtr<FormState>&&, CompletionHandler<void()>&&);
     373    void loadURL(FrameLoadRequest&&, const String& referrer, FrameLoadType, Event*, RefPtr<FormState>&&, CompletionHandler<void()>&&);
    374374
    375375    bool shouldReload(const URL& currentURL, const URL& destinationURL);

  • trunk/Source/WebCore/loader/NavigationScheduler.cpp

    r231008 r232147  
    275275        FrameLoadRequest frameLoadRequest { requestingDocument, requestingDocument.securityOrigin(), { }, { }, lockHistory(), lockBackForwardList(), MaybeSendReferrer, AllowNavigationToInvalidURL::Yes, NewFrameOpenerPolicy::Allow, shouldOpenExternalURLs(), initiatedByMainFrame() };
    276276        m_submission->populateFrameLoadRequest(frameLoadRequest);
    277         frame.loader().loadFrameRequest(WTFMove(frameLoadRequest), m_submission->event(), &m_submission->state());
     277        frame.loader().loadFrameRequest(WTFMove(frameLoadRequest), m_submission->event(), m_submission->takeState());
    278278    }
    279279

  • trunk/Source/WebCore/loader/PolicyChecker.cpp

    r232093 r232147  
    11/*
    2  * Copyright (C) 2006-2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2006-2018 Apple Inc. All rights reserved.
    33 * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
    44 * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
    … …  
    8282void PolicyChecker::checkNavigationPolicy(ResourceRequest&& newRequest, bool didReceiveRedirectResponse, NavigationPolicyDecisionFunction&& function)
    8383{
    84     checkNavigationPolicy(WTFMove(newRequest), didReceiveRedirectResponse, m_frame.loader().activeDocumentLoader(), nullptr, WTFMove(function));
     84    checkNavigationPolicy(WTFMove(newRequest), didReceiveRedirectResponse, m_frame.loader().activeDocumentLoader(), { }, WTFMove(function));
    8585}
    8686
    … …  
    9999}
    100100
    101 void PolicyChecker::checkNavigationPolicy(ResourceRequest&& request, bool didReceiveRedirectResponse, DocumentLoader* loader, FormState* formState, NavigationPolicyDecisionFunction&& function, PolicyDecisionMode policyDecisionMode)
     101void PolicyChecker::checkNavigationPolicy(ResourceRequest&& request, bool didReceiveRedirectResponse, DocumentLoader* loader, RefPtr<FormState>&& formState, NavigationPolicyDecisionFunction&& function, PolicyDecisionMode policyDecisionMode)
    102102{
    103103    NavigationAction action = loader->triggeringAction();
    … …  
    110110    // This avoids confusion on the part of the client.
    111111    if (equalIgnoringHeaderFields(request, loader->lastCheckedRequest()) || (!request.isNull() && request.url().isEmpty())) {
    112         function(ResourceRequest(request), nullptr, ShouldContinue::Yes);
     112        function(ResourceRequest(request), { }, ShouldContinue::Yes);
    113113        loader->setLastCheckedRequest(WTFMove(request));
    114114        return;
    … …  
    125125        if (isBackForwardLoadType(m_loadType))
    126126            m_loadType = FrameLoadType::Reload;
    127         function(WTFMove(request), nullptr, shouldContinue ? ShouldContinue::Yes : ShouldContinue::No);
     127        function(WTFMove(request), { }, shouldContinue ? ShouldContinue::Yes : ShouldContinue::No);
    128128        return;
    129129    }
    … …  
    135135            m_frame.ownerElement()->dispatchEvent(Event::create(eventNames().loadEvent, false, false));
    136136        }
    137         function(WTFMove(request), nullptr, ShouldContinue::No);
     137        function(WTFMove(request), { }, ShouldContinue::No);
    138138        return;
    139139    }
    … …  
    148148    // Always allow QuickLook-generated URLs based on the protocol scheme.
    149149    if (!request.isNull() && isQuickLookPreviewURL(request.url()))
    150         return function(WTFMove(request), formState, ShouldContinue::Yes);
     150        return function(WTFMove(request), makeWeakPtr(formState.get()), ShouldContinue::Yes);
    151151#endif
    152152
    … …  
    169169    m_delegateIsDecidingNavigationPolicy = true;
    170170    String suggestedFilename = action.downloadAttribute().isEmpty() ? nullAtom() : action.downloadAttribute();
    171     m_frame.loader().client().dispatchDecidePolicyForNavigationAction(action, request, didReceiveRedirectResponse, formState, policyDecisionMode, [this, function = WTFMove(function), request = ResourceRequest(request), formState = makeRefPtr(formState), suggestedFilename = WTFMove(suggestedFilename), blobURLLifetimeExtension = WTFMove(blobURLLifetimeExtension)](PolicyAction policyAction) mutable {
     171    m_frame.loader().client().dispatchDecidePolicyForNavigationAction(action, request, didReceiveRedirectResponse, formState.get(), policyDecisionMode, [this, function = WTFMove(function), request = ResourceRequest(request), formState = WTFMove(formState), suggestedFilename = WTFMove(suggestedFilename), blobURLLifetimeExtension = WTFMove(blobURLLifetimeExtension)](PolicyAction policyAction) mutable {
    172172        m_delegateIsDecidingNavigationPolicy = false;
    173173
    … …  
    184184            if (!m_frame.loader().client().canHandleRequest(request)) {
    185185                handleUnimplementablePolicy(m_frame.loader().client().cannotShowURLError(request));
    186                 return function({ }, nullptr, ShouldContinue::No);
     186                return function({ }, { }, ShouldContinue::No);
    187187            }
    188             return function(WTFMove(request), formState.get(), ShouldContinue::Yes);
     188            return function(WTFMove(request), makeWeakPtr(formState.get()), ShouldContinue::Yes);
    189189        }
    190190        ASSERT_NOT_REACHED();
    … …  
    192192}
    193193
    194 void PolicyChecker::checkNewWindowPolicy(NavigationAction&& navigationAction, ResourceRequest&& request, FormState* formState, const String& frameName, NewWindowPolicyDecisionFunction&& function)
     194void PolicyChecker::checkNewWindowPolicy(NavigationAction&& navigationAction, ResourceRequest&& request, RefPtr<FormState>&& formState, const String& frameName, NewWindowPolicyDecisionFunction&& function)
    195195{
    196196    if (m_frame.document() && m_frame.document()->isSandboxed(SandboxPopups))
    … …  
    202202    auto blobURLLifetimeExtension = extendBlobURLLifetimeIfNecessary(request);
    203203
    204     m_frame.loader().client().dispatchDecidePolicyForNewWindowAction(navigationAction, request, formState, frameName, [frame = makeRef(m_frame), request, formState = makeRefPtr(formState), frameName, navigationAction, function = WTFMove(function), blobURLLifetimeExtension = WTFMove(blobURLLifetimeExtension)](PolicyAction policyAction) mutable {
     204    m_frame.loader().client().dispatchDecidePolicyForNewWindowAction(navigationAction, request, formState.get(), frameName, [frame = makeRef(m_frame), request, formState = WTFMove(formState), frameName, navigationAction, function = WTFMove(function), blobURLLifetimeExtension = WTFMove(blobURLLifetimeExtension)](PolicyAction policyAction) mutable {
    205205        switch (policyAction) {
    206206        case PolicyAction::Download:
    … …  
    214214            RELEASE_ASSERT_NOT_REACHED();
    215215        case PolicyAction::Use:
    216             function(request, formState.get(), frameName, navigationAction, ShouldContinue::Yes);
     216            function(request, makeWeakPtr(formState.get()), frameName, navigationAction, ShouldContinue::Yes);
    217217            return;
    218218        }

  • trunk/Source/WebCore/loader/PolicyChecker.h

    r232093 r232147  
    11/*
    2  * Copyright (C) 2006-2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2006-2018 Apple Inc. All rights reserved.
    33 * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
    44 *
    … …  
    3232#include "FrameLoaderTypes.h"
    3333#include "ResourceRequest.h"
     34#include <wtf/WeakPtr.h>
    3435#include <wtf/text/WTFString.h>
    3536
    … …  
    6061enum class PolicyDecisionMode { Synchronous, Asynchronous };
    6162
    62 using NewWindowPolicyDecisionFunction = CompletionHandler<void(const ResourceRequest&, FormState*, const String& frameName, const NavigationAction&, ShouldContinue)>;
    63 using NavigationPolicyDecisionFunction = CompletionHandler<void(ResourceRequest&&, FormState*, ShouldContinue)>;
     63using NewWindowPolicyDecisionFunction = CompletionHandler<void(const ResourceRequest&, WeakPtr<FormState>&&, const String& frameName, const NavigationAction&, ShouldContinue)>;
     64using NavigationPolicyDecisionFunction = CompletionHandler<void(ResourceRequest&&, WeakPtr<FormState>&&, ShouldContinue)>;
    6465
    6566class PolicyChecker {
    … …  
    6970    explicit PolicyChecker(Frame&);
    7071
    71     void checkNavigationPolicy(ResourceRequest&&, bool didReceiveRedirectResponse, DocumentLoader*, FormState*, NavigationPolicyDecisionFunction&&, PolicyDecisionMode = PolicyDecisionMode::Asynchronous);
     72    void checkNavigationPolicy(ResourceRequest&&, bool didReceiveRedirectResponse, DocumentLoader*, RefPtr<FormState>&&, NavigationPolicyDecisionFunction&&, PolicyDecisionMode = PolicyDecisionMode::Asynchronous);
    7273    void checkNavigationPolicy(ResourceRequest&&, bool didReceiveRedirectResponse, NavigationPolicyDecisionFunction&&);
    73     void checkNewWindowPolicy(NavigationAction&&, ResourceRequest&&, FormState*, const String& frameName, NewWindowPolicyDecisionFunction&&);
     74    void checkNewWindowPolicy(NavigationAction&&, ResourceRequest&&, RefPtr<FormState>&&, const String& frameName, NewWindowPolicyDecisionFunction&&);
    7475
    7576    void stopCheck();

  • trunk/Source/WebCore/page/ContextMenuController.cpp

    r230211 r232147  
    197197        return;
    198198    newPage->chrome().show();
    199     newPage->mainFrame().loader().loadFrameRequest(WTFMove(frameLoadRequest), nullptr, nullptr);
     199    newPage->mainFrame().loader().loadFrameRequest(WTFMove(frameLoadRequest), nullptr, { });
    200200}
    201201
    … …  
    398398            ResourceRequest resourceRequest { m_context.hitTestResult().absoluteLinkURL(), frame->loader().outgoingReferrer() };
    399399            FrameLoadRequest frameLoadRequest { *frame->document(), frame->document()->securityOrigin(), resourceRequest, { }, LockHistory::No, LockBackForwardList::No, MaybeSendReferrer, AllowNavigationToInvalidURL::Yes, NewFrameOpenerPolicy::Suppress, targetFrame->isMainFrame() ? ShouldOpenExternalURLsPolicy::ShouldAllow : ShouldOpenExternalURLsPolicy::ShouldNotAllow, InitiatedByMainFrame::Unknown };
    400             targetFrame->loader().loadFrameRequest(WTFMove(frameLoadRequest), nullptr, nullptr);
     400            targetFrame->loader().loadFrameRequest(WTFMove(frameLoadRequest), nullptr,  { });
    401401        } else
    402402            openNewWindow(m_context.hitTestResult().absoluteLinkURL(), *frame, ShouldOpenExternalURLsPolicy::ShouldAllow);
Note: See TracChangeset for help on using the changeset viewer.