Changeset 259378 in webkit

Timestamp:

Apr 1, 2020 10:22:48 PM (4 years ago)

Author:

rniwa@webkit.org

Message:

Crash in WebCore::HTMLDocumentParser::insert
​https://bugs.webkit.org/show_bug.cgi?id=209892

Reviewed by Darin Adler.

Speculative fix to check that the parser hasn't been detached before running preload scanner.

No new tests since there is no reproduction and I couldn't come up with one.

• html/parser/HTMLDocumentParser.cpp:

(WebCore::HTMLDocumentParser::pumpTokenizer):
(WebCore::HTMLDocumentParser::insert):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/parser/HTMLDocumentParser.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-04-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in WebCore::HTMLDocumentParser::insert
+        https://bugs.webkit.org/show_bug.cgi?id=209892
+
+        Reviewed by Darin Adler.
+
+        Speculative fix to check that the parser hasn't been detached before running preload scanner.
+
+        No new tests since there is no reproduction and I couldn't come up with one.
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::pumpTokenizer):
+        (WebCore::HTMLDocumentParser::insert):
+
 2020-04-01  Jack Lee  <shihchieh_lee@apple.com>
 

trunk/Source/WebCore/html/parser/HTMLDocumentParser.cpp

@@ -334 +334 @@
         m_parserScheduler->scheduleForResume();
 
-    if (isWaitingForScripts()) {
+    if (isWaitingForScripts() && !isDetached()) {
         ASSERT(m_tokenizer.isInDataState());
         if (!m_preloadScanner) {
@@ -392 +392 @@
     pumpTokenizerIfPossible(ForceSynchronous);
 
-    if (isWaitingForScripts()) {
+    if (isWaitingForScripts() && !isDetached()) {
         // Check the document.write() output with a separate preload scanner as
         // the main scanner can't deal with insertions.