Changeset 59378 in webkit

Timestamp:

May 13, 2010 11:59:08 AM (14 years ago)

Author:

tonikitoo@webkit.org

Message:

[Qt] REGRESSION(r58497) tst_QGraphicsWebView::crashOnViewlessWebPages() is failing
​https://bugs.webkit.org/show_bug.cgi?id=38655

Patch by Kenneth Rohde Christiansen <​kenneth@webkit.org> on 2010-05-11
Reviewed by Laszlo Gombos.

Fix double free by moving the connect till after the resize.

The bug is causes by the fact that a resize of an empty page causes a
layout, thus deleting the qgraphicswebview before setHtml is called,
which then deletes it again, causing a double free.

• tests/qgraphicswebview/tst_qgraphicswebview.cpp:

(tst_QGraphicsWebView::crashOnViewlessWebPages):

Location:

trunk/WebKit/qt

Files:

• ChangeLog (modified) (1 diff)
• tests/qgraphicswebview/tst_qgraphicswebview.cpp (modified) (3 diffs)

trunk/WebKit/qt/ChangeLog

@@ +1 @@
+2010-05-11  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] REGRESSION(r58497) tst_QGraphicsWebView::crashOnViewlessWebPages() is failing
+        https://bugs.webkit.org/show_bug.cgi?id=38655
+
+        Fix double free by moving the connect till after the resize.
+
+        The bug is causes by the fact that a resize of an empty page causes a
+        layout, thus deleting the qgraphicswebview before setHtml is called,
+        which then deletes it again, causing a double free.
+
+        * tests/qgraphicswebview/tst_qgraphicswebview.cpp:
+        (tst_QGraphicsWebView::crashOnViewlessWebPages):
+
 2010-05-12  Kenneth Rohde Christiansen  <kenneth@webkit.org>
 

trunk/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp

@@ -85 +85 @@
     webView->setPage(page);
     page->webView = webView;
-    connect(page->mainFrame(), SIGNAL(initialLayoutCompleted()), page, SLOT(aborting()));
-
     scene.addItem(webView);
 
@@ -92 +90 @@
     view.resize(600, 480);
     webView->resize(view.geometry().size());
+
     QCoreApplication::processEvents();
     view.show();
+
+    // Resizing the page will resize and layout the empty "about:blank"
+    // page, so we first connect the signal afterward.
+    connect(page->mainFrame(), SIGNAL(initialLayoutCompleted()), page, SLOT(aborting()));
 
     page->mainFrame()->setHtml(QString("data:text/html,"
@@ -102 +105 @@
 
     QVERIFY(waitForSignal(page, SIGNAL(loadFinished(bool))));
+    delete page;
 }