Title: [188765] trunk/Source/WebCore
- Revision
- 188765
- Author
- [email protected]
- Date
- 2015-08-21 12:23:09 -0700 (Fri, 21 Aug 2015)
Log Message
HistoryItems will null CachedPages should never be left in the list of items;
causes crash
https://bugs.webkit.org/show_bug.cgi?id=148237
-and corresponding-
rdar://problem/22356782
Reviewed by Brady Eidson.
Setting the CachedPage to nullptr will destroy the CachedPage, destroy the
FrameView, re-enter layout, and potentially try to modify items in the PageCache
based on that layout. So, we should not modify CachedPage in this way while the
item is still in the list of HistoryItems.
* history/PageCache.cpp:
(WebCore::PageCache::take):
(WebCore::PageCache::remove):
(WebCore::PageCache::prune):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (188764 => 188765)
--- trunk/Source/WebCore/ChangeLog 2015-08-21 19:11:36 UTC (rev 188764)
+++ trunk/Source/WebCore/ChangeLog 2015-08-21 19:23:09 UTC (rev 188765)
@@ -1,3 +1,22 @@
+2015-08-21 Beth Dakin <[email protected]>
+
+ HistoryItems will null CachedPages should never be left in the list of items;
+ causes crash
+ https://bugs.webkit.org/show_bug.cgi?id=148237
+ -and corresponding-
+ rdar://problem/22356782
+
+ Reviewed by Brady Eidson.
+
+ Setting the CachedPage to nullptr will destroy the CachedPage, destroy the
+ FrameView, re-enter layout, and potentially try to modify items in the PageCache
+ based on that layout. So, we should not modify CachedPage in this way while the
+ item is still in the list of HistoryItems.
+ * history/PageCache.cpp:
+ (WebCore::PageCache::take):
+ (WebCore::PageCache::remove):
+ (WebCore::PageCache::prune):
+
2015-08-21 David Kilzer <[email protected]>
dispatch_group_t objects may not be retained properly when not backed by Objective-C objects under garbage collection
Modified: trunk/Source/WebCore/history/PageCache.cpp (188764 => 188765)
--- trunk/Source/WebCore/history/PageCache.cpp 2015-08-21 19:11:36 UTC (rev 188764)
+++ trunk/Source/WebCore/history/PageCache.cpp 2015-08-21 19:23:09 UTC (rev 188765)
@@ -396,8 +396,8 @@
return nullptr;
}
- std::unique_ptr<CachedPage> cachedPage = WTF::move(item.m_cachedPage);
m_items.remove(&item);
+ std::unique_ptr<CachedPage> cachedPage = WTF::move(item.m_cachedPage);
if (cachedPage->hasExpired()) {
LOG(PageCache, "Not restoring page for %s from back/forward cache because cache entry has expired", item.url().string().ascii().data());
@@ -432,17 +432,16 @@
if (!item.m_cachedPage)
return;
- item.m_cachedPage = nullptr;
m_items.remove(&item);
+ item.m_cachedPage = nullptr;
}
void PageCache::prune(PruningReason pruningReason)
{
while (pageCount() > maxSize()) {
- auto& oldestItem = m_items.first();
+ auto oldestItem = m_items.takeFirst();
oldestItem->m_cachedPage = nullptr;
oldestItem->m_pruningReason = pruningReason;
- m_items.removeFirst();
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
