Changeset 49786 in webkit

Timestamp:

Oct 19, 2009 9:00:18 AM (15 years ago)

Author:

eric@webkit.org

Message:

2009-10-19 Dmitry Titov <​dimich@chromium.org>

Reviewed by Adam Barth.

Crash in DOMWindow::clearTimeout etc when DOMWindow is not connected to a frame.
​https://bugs.webkit.org/show_bug.cgi?id=29832

Need to make sure the script caches are reset when frame gets disconnected from still-alive DOMWindow.
This will prevent JS from calling DOMWindow methods that can not be completed w/o the frame.

I am not sure it's possible to test this since the only file that repros the problem need ~10 seconds to cause crash.

• page/Frame.cpp: (WebCore::Frame::~Frame): Right after frame disconnects from DOMWindow, clear WindowShell.

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• page/Frame.cpp (modified) (1 diff)

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-10-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Crash in DOMWindow::clearTimeout etc when DOMWindow is not connected to a frame.
+        https://bugs.webkit.org/show_bug.cgi?id=29832
+
+        Need to make sure the script caches are reset when frame gets disconnected from still-alive DOMWindow.
+        This will prevent JS from calling DOMWindow methods that can not be completed w/o the frame.
+
+        I am not sure it's possible to test this since the only file that repros the problem need ~10 seconds to cause crash.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::~Frame): Right after frame disconnects from DOMWindow, clear WindowShell.
+
 2009-10-19  Csaba Osztrogonác  <ossy@webkit.org>
 

trunk/WebCore/page/Frame.cpp

@@ -199 +199 @@
     if (m_domWindow)
         m_domWindow->disconnectFrame();
+    script()->clearWindowShell();
 
     HashSet<DOMWindow*>::iterator end = m_liveFormerWindows.end();