Title: [139378] branches/chromium/1364
- Revision
- 139378
- Author
- [email protected]
- Date
- 2013-01-10 15:19:26 -0800 (Thu, 10 Jan 2013)
Log Message
Merge 138918
BUG=167147
Review URL: https://codereview.chromium.org/11827065
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1364/LayoutTests/fast/dom/window-load-crash-expected.txt (from rev 138918, trunk/LayoutTests/fast/dom/window-load-crash-expected.txt) (0 => 139378)
--- branches/chromium/1364/LayoutTests/fast/dom/window-load-crash-expected.txt (rev 0)
+++ branches/chromium/1364/LayoutTests/fast/dom/window-load-crash-expected.txt 2013-01-10 23:19:26 UTC (rev 139378)
@@ -0,0 +1,2 @@
+Blocked access to external URL http://blocked/does-not-exist.html
+Test passes if it does not crash.
Copied: branches/chromium/1364/LayoutTests/fast/dom/window-load-crash.html (from rev 138918, trunk/LayoutTests/fast/dom/window-load-crash.html) (0 => 139378)
--- branches/chromium/1364/LayoutTests/fast/dom/window-load-crash.html (rev 0)
+++ branches/chromium/1364/LayoutTests/fast/dom/window-load-crash.html 2013-01-10 23:19:26 UTC (rev 139378)
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+Test passes if it does not crash.
+<base href=""
+<script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+}
+
+function crash()
+{
+ GCController.collect();
+ if (window.testRunner)
+ testRunner.notifyDone();
+}
+</script>
+<iframe _onload_=crash() src="" srcdoc="<script>window._onload_ = function() { frames[0].document.getElementsByTagName('a')[0].click(); }</script><iframe seamless srcdoc='<a href=""
+</html>
Modified: branches/chromium/1364/Source/WebCore/dom/Document.cpp (139377 => 139378)
--- branches/chromium/1364/Source/WebCore/dom/Document.cpp 2013-01-10 23:18:01 UTC (rev 139377)
+++ branches/chromium/1364/Source/WebCore/dom/Document.cpp 2013-01-10 23:19:26 UTC (rev 139378)
@@ -2384,6 +2384,9 @@
if (!doload)
return;
+ // Call to dispatchWindowLoadEvent can blow us from underneath.
+ RefPtr<Document> protect(this);
+
m_processingLoadEvent = true;
ScriptableDocumentParser* parser = scriptableDocumentParser();
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
