Changeset 80686 in webkit

Timestamp:

Mar 9, 2011 6:55:02 PM (13 years ago)

Author:

mihaip@chromium.org

Message:

2011-03-09 Mihai Parparita <​mihaip@chromium.org>

Reviewed by Tony Gentilcore.

REGRESSION (r74807): memory corruption after CachedResourceLoader refactoring
​https://bugs.webkit.org/show_bug.cgi?id=53045

Copy the URL out of the CachedResource that is being revalidated, so
that we can still use it (in m_validatedURLs) after removing the
resource from the memory cache, which may delete it.

No new tests, since I was not able to trigger this locally (in a layout
test or otherwise).

• loader/cache/CachedResourceLoader.cpp: (WebCore::CachedResourceLoader::revalidateResource):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• loader/cache/CachedResourceLoader.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-03-09  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Tony Gentilcore.
+
+        REGRESSION (r74807): memory corruption after CachedResourceLoader refactoring
+        https://bugs.webkit.org/show_bug.cgi?id=53045
+        
+        Copy the URL out of the CachedResource that is being revalidated, so
+        that we can still use it (in m_validatedURLs) after removing the
+        resource from the memory cache, which may delete it.
+
+        No new tests, since I was not able to trigger this locally (in a layout
+        test or otherwise).
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::revalidateResource):
+
 2011-03-09  Chris Fleizach  <cfleizach@apple.com>
 

trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp

@@ -341 +341 @@
     ASSERT(!resource->resourceToRevalidate());
     
-    const String& url = resource->url();
+    // Copy the URL out of the resource to be revalidated in case it gets deleted by the remove() call below.
+    String url = resource->url();
     CachedResource* newResource = createResource(resource->type(), KURL(ParsedURLString, url), resource->encoding());