Changeset 246187 in webkit

Timestamp:

Jun 6, 2019 10:14:35 PM (5 years ago)

Author:

Chris Dumez

Message:

RELEASE_ASSERT hit in CachedFrame constructor
​https://bugs.webkit.org/show_bug.cgi?id=198625
<rdar://problem/49877867>

Reviewed by Geoffrey Garen.

This is a speculative fix, it appears the document is already detached from its
frame by the time we construct a CachedFrame for it when entering PageCache.

No new tests, because we do not know yet how this can be reproduced.

• history/PageCache.cpp:

(WebCore::canCacheFrame):
Make a frame as ineligible for PageCache if:

1. It does not have a document

or

2. Its document is already detached from the frame

(WebCore::PageCache::addIfCacheable):
Destroy the render tree *before* we check if the page can enter page cache, in case
destroying the render tree has any side effects that could make the page ineligible
for Page Cache.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• history/PageCache.cpp (modified) (3 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-06-06  Chris Dumez  <cdumez@apple.com>
+
+        RELEASE_ASSERT hit in CachedFrame constructor
+        https://bugs.webkit.org/show_bug.cgi?id=198625
+        <rdar://problem/49877867>
+
+        Reviewed by Geoffrey Garen.
+
+        This is a speculative fix, it appears the document is already detached from its
+        frame by the time we construct a CachedFrame for it when entering PageCache.
+
+        No new tests, because we do not know yet how this can be reproduced.
+
+        * history/PageCache.cpp:
+        (WebCore::canCacheFrame):
+        Make a frame as ineligible for PageCache if:
+        1. It does not have a document
+        or
+        2. Its document is already detached from the frame
+
+        (WebCore::PageCache::addIfCacheable):
+        Destroy the render tree *before* we check if the page can enter page cache, in case
+        destroying the render tree has any side effects that could make the page ineligible
+        for Page Cache.
+
 2019-06-06  Devin Rousso  <drousso@apple.com>
 

trunk/Source/WebCore/history/PageCache.cpp

@@ -91 +91 @@
     }
 
+    if (!frame.document()) {
+        PCLOG("   -Frame has no document");
+        return false;
+    }
+
+    if (!frame.document()->frame()) {
+        PCLOG("   -Document is detached from frame");
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
     DocumentLoader* documentLoader = frameLoader.documentLoader();
     if (!documentLoader) {
@@ -446 +457 @@
     firePageHideEventRecursively(page->mainFrame());
 
+    destroyRenderTree(page->mainFrame());
+
     // Check that the page is still page-cacheable after firing the pagehide event. The JS event handlers
     // could have altered the page in a way that could prevent caching.
@@ -452 +465 @@
         return false;
     }
-
-    destroyRenderTree(page->mainFrame());
 
     setPageCacheState(*page, Document::InPageCache);