Changeset 87693 in webkit

Timestamp:

May 30, 2011 10:21:14 AM (13 years ago)

Author:

abarth@webkit.org

Message:

2011-05-30 Mikhail Naganov <​mnaganov@chromium.org>

Reviewed by Adam Barth.

[Chromium] Fix regression after r87628.
​https://bugs.webkit.org/show_bug.cgi?id=61733

Having r87628 in place, Chrome reliability bot crashes in
WebCore::HTMLLinkElement::onloadTimerFired.

This is because the change makes WebCore::CachedResource::setRequest to
call checkNotify on request reset. HTMLLinkElement registers itself as
CachedResource client via m_cachedSheet, which can happen even if
m_cachedLinkResource wasn't set. As a result,
WebCore::HTMLLinkElement::notifyFinished is got called with unset
m_cachedLinkResource, which causes a crash in
HTMLLinkElement::onloadTimerFired

• html/HTMLLinkElement.cpp: (WebCore::HTMLLinkElement::notifyFinished):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/HTMLLinkElement.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-05-30  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [Chromium] Fix regression after r87628.
+        https://bugs.webkit.org/show_bug.cgi?id=61733
+
+        Having r87628 in place, Chrome reliability bot crashes in
+        WebCore::HTMLLinkElement::onloadTimerFired.
+
+        This is because the change makes WebCore::CachedResource::setRequest to
+        call checkNotify on request reset.  HTMLLinkElement registers itself as
+        CachedResource client via m_cachedSheet, which can happen even if
+        m_cachedLinkResource wasn't set.  As a result,
+        WebCore::HTMLLinkElement::notifyFinished is got called with unset
+        m_cachedLinkResource, which causes a crash in
+        HTMLLinkElement::onloadTimerFired
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::notifyFinished):
+
 2011-05-30  Jer Noble  <jer.noble@apple.com>
 

trunk/Source/WebCore/html/HTMLLinkElement.cpp

@@ -76 +76 @@
 
     if (m_cachedSheet) {
-        m_cachedSheet->removeClient(this);    
+        m_cachedSheet->removeClient(this);
         removePendingSheet();
     }
@@ -458 +458 @@
 void HTMLLinkElement::notifyFinished(CachedResource* resource)
 {
-    m_onloadTimer.startOneShot(0);
-    ASSERT(m_cachedLinkResource.get() == resource);
+    ASSERT(m_cachedLinkResource.get() == resource || m_cachedSheet.get() == resource);
+    if (m_cachedLinkResource.get() == resource)
+        m_onloadTimer.startOneShot(0);
 }
 #endif