Changeset 75935 in webkit

Timestamp:

Jan 17, 2011 5:28:53 AM (13 years ago)

Author:

kbalazs@webkit.org

Message:

2011-01-17 Balazs Kelemen <​kbalazs@webkit.org>

Reviewed by Andreas Kling.

[Qt][WK2] Crash due to double destruction of QSharedMemory
​https://bugs.webkit.org/show_bug.cgi?id=52569

Avoid deleting the QSharedMemory twice.

• Platform/qt/SharedMemoryQt.cpp: (WebKit::SharedMemory::~SharedMemory):
• Shared/qt/CleanupHandler.cpp: Renamed m_inDeleteObjects to m_hasStartedDeleting and added a getter for it. (WebKit::CleanupHandler::CleanupHandler): (WebKit::CleanupHandler::deleteObjects):
• Shared/qt/CleanupHandler.h: (WebKit::CleanupHandler::unmark): (WebKit::CleanupHandler::hasStartedDeleting):

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• Platform/qt/SharedMemoryQt.cpp (modified) (1 diff)
• Shared/qt/CleanupHandler.cpp (modified) (2 diffs)
• Shared/qt/CleanupHandler.h (modified) (2 diffs)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2011-01-17  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt][WK2] Crash due to double destruction of QSharedMemory
+        https://bugs.webkit.org/show_bug.cgi?id=52569
+
+        Avoid deleting the QSharedMemory twice.
+        * Platform/qt/SharedMemoryQt.cpp:
+        (WebKit::SharedMemory::~SharedMemory):
+        * Shared/qt/CleanupHandler.cpp:
+        Renamed m_inDeleteObjects to m_hasStartedDeleting and
+        added a getter for it.
+        (WebKit::CleanupHandler::CleanupHandler):
+        (WebKit::CleanupHandler::deleteObjects):
+        * Shared/qt/CleanupHandler.h:
+        (WebKit::CleanupHandler::unmark):
+        (WebKit::CleanupHandler::hasStartedDeleting):
+
 2011-01-15  Adam Barth  <abarth@webkit.org>
 

trunk/Source/WebKit2/Platform/qt/SharedMemoryQt.cpp

@@ -145 +145 @@
 SharedMemory::~SharedMemory()
 {
+    if (CleanupHandler::instance()->hasStartedDeleting())
+        return;
+
     CleanupHandler::instance()->unmark(m_impl);
     delete m_impl;

trunk/Source/WebKit2/Shared/qt/CleanupHandler.cpp

@@ -37 +37 @@
 
 CleanupHandler::CleanupHandler()
-    : m_inDeleteObjects(false)
+    : m_hasStartedDeleting(false)
 {
     moveToThread(qApp->thread()); // Ensure that we are acting on the main thread.
@@ -51 +51 @@
 void CleanupHandler::deleteObjects()
 {
-    m_inDeleteObjects = true;
+    m_hasStartedDeleting = true;
     for (unsigned i = 0; i < m_objects.size(); ++i)
         m_objects[i]->deleteLater();

trunk/Source/WebKit2/Shared/qt/CleanupHandler.h

@@ -52 +52 @@
     void unmark(QObject* object)
     {
-        if (m_inDeleteObjects)
+        if (m_hasStartedDeleting)
             return;
         m_objects.removeOne(object);
     }
+
+    bool hasStartedDeleting() const { return m_hasStartedDeleting; }
 
 private slots:
@@ -67 +69 @@
 
     QList<QObject*> m_objects;
-    bool m_inDeleteObjects;
+    bool m_hasStartedDeleting;
 };