Fix crashes in GC creating a document fragment on a background thread
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 3 Aug 2017 03:49:53 +0000 (03:49 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 3 Aug 2017 03:49:53 +0000 (03:49 +0000)
commit37d5152c96df09630641b728166edd82ea25bd45
tree267269c78f26d85b2302e76ba5c96df85ebce760
parent675f0f248c12b633bf576f936db805dbe4f629d0
Fix crashes in GC creating a document fragment on a background thread
https://bugs.webkit.org/show_bug.cgi?id=175111

Patch by Sam Weinig <sam@webkit.org> on 2017-08-02
Reviewed by Chris Dumez.

r220095 (https://webkit.org/b/175006) change JSHTMLTemplateElement from using a
private name + property to manager the lifetime of the reference DocumentFragment
to using the idiomatic visitAdditionalChildren. Unfortunately, the function to access
the DocumentFragment lazily creates it. If this lazy creation happens on a GC thread,
badness ensues. This introduces an accessor that returns the DocumentFragment if it
has been created or null if it has not.

* bindings/js/JSHTMLTemplateElementCustom.cpp:
(WebCore::JSHTMLTemplateElement::visitAdditionalChildren):
* html/HTMLTemplateElement.cpp:
(WebCore::HTMLTemplateElement::contentIfAvailable):
* html/HTMLTemplateElement.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@220177 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebCore/ChangeLog
Source/WebCore/bindings/js/JSHTMLTemplateElementCustom.cpp
Source/WebCore/html/HTMLTemplateElement.cpp
Source/WebCore/html/HTMLTemplateElement.h