Reviewed by Ken and Maciej.

	New fix for <rdar://problem/3667701> crash in KHTMLPart::jScriptEnabled()

	The tokenizer has buffers which mean parsing can continue even after loading is supposed to be stopped. If the loading process was aborted, the tokenizer should abort, too.

        * khtml/html/htmltokenizer.cpp:
        (khtml::HTMLTokenizer::HTMLTokenizer): Initialize loadStopped to false.
        (khtml::HTMLTokenizer::write): Go ahead and bail out if loadStopped is true.
        (khtml::HTMLTokenizer::processToken):
        * khtml/html/htmltokenizer.h: Added loadStopped flag. Changed the view pointer from a standard pointer to a QGuardedPtr.  This fixes the crash.  Now the tokenizer's handle to the view will now automatically nil-out and never dangle.
        * khtml/khtml_part.cpp:
        (KHTMLPart::closeURL): Notify the tokenizer to stop parsing.
        * khtml/xml/xml_tokenizer.cpp:
        (khtml::XMLTokenizer::XMLTokenizer): Initialize loadStopped to false.
        * khtml/xml/xml_tokenizer.h:
        (khtml::Tokenizer::stopParsing): Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@8892 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebCore/ChangeLog-2005-08-23 b/WebCore/ChangeLog-2005-08-23
index 91c0263371fae872d33678fd0d698d96034e3e00..9c7621d131c748176b1d98034d7f0d2a1e50c4ea 100644 (file)
--- a/WebCore/ChangeLog-2005-08-23
+++ b/WebCore/ChangeLog-2005-08-23
@@ -1,3 +1,23 @@
+2005-03-15  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Ken and Maciej.
+
+       New fix for <rdar://problem/3667701> crash in KHTMLPart::jScriptEnabled()
+       
+       The tokenizer has buffers which mean parsing can continue even after loading is supposed to be stopped. If the loading process was aborted, the tokenizer should abort, too.
+
+        * khtml/html/htmltokenizer.cpp:
+        (khtml::HTMLTokenizer::HTMLTokenizer): Initialize loadStopped to false.
+        (khtml::HTMLTokenizer::write): Go ahead and bail out if loadStopped is true. 
+        (khtml::HTMLTokenizer::processToken):
+        * khtml/html/htmltokenizer.h: Added loadStopped flag. Changed the view pointer from a standard pointer to a QGuardedPtr.  This fixes the crash.  Now the tokenizer's handle to the view will now automatically nil-out and never dangle.
+        * khtml/khtml_part.cpp:
+        (KHTMLPart::closeURL): Notify the tokenizer to stop parsing. 
+        * khtml/xml/xml_tokenizer.cpp:
+        (khtml::XMLTokenizer::XMLTokenizer): Initialize loadStopped to false.
+        * khtml/xml/xml_tokenizer.h:
+        (khtml::Tokenizer::stopParsing): Added. 
+
 2005-03-14  David Harrison  <harrison@apple.com>
 
         Reviewed by Darin, Maciej.

diff --git a/WebCore/khtml/html/htmltokenizer.cpp b/WebCore/khtml/html/htmltokenizer.cpp
index 27c893a788b11157a8565cda2f2431907882d4ea..606f506eca61943e97825e1d923ae6b9c99f5aa3 100644 (file)
--- a/WebCore/khtml/html/htmltokenizer.cpp
+++ b/WebCore/khtml/html/htmltokenizer.cpp
@@ -250,6 +250,7 @@ HTMLTokenizer::HTMLTokenizer(DOM::DocumentPtr *_doc, KHTMLView *_view, bool incl
     attrNamePresent = false;
     timerId = 0;
     includesCommentsInDOM = includesComments;
+    loadStopped = false;
     
     begin();
 }
@@ -270,6 +271,7 @@ HTMLTokenizer::HTMLTokenizer(DOM::DocumentPtr *_doc, DOM::DocumentFragmentImpl *
     onHold = false;
     timerId = 0;
     includesCommentsInDOM = includesComments;
+    loadStopped = false;
 
     begin();
 }
@@ -1533,6 +1535,9 @@ void HTMLTokenizer::write(const TokenizerString &str, bool appendData)
 
     if (!buffer)
         return;
+    
+    if (loadStopped)
+        return;
 
     if ( ( m_executingScript && appendData ) || !cachedScript.isEmpty() ) {
         // don't parse; we will do this later
@@ -2008,9 +2013,12 @@ void HTMLTokenizer::processToken()
     }
     kdDebug( 6036 ) << endl;
 #endif
-    // pass the token over to the parser, the parser DOES NOT delete the token
-    parser->parseToken(&currToken);
-
+    
+    if (!loadStopped) {
+        // pass the token over to the parser, the parser DOES NOT delete the token
+        parser->parseToken(&currToken);
+    }
+    
     currToken.reset();
     if (jsProxy)
         jsProxy->setEventHandlerLineno(0);

diff --git a/WebCore/khtml/html/htmltokenizer.h b/WebCore/khtml/html/htmltokenizer.h
index a452920f84719ce5878049b253812f993c8b556e..98c41f6a34119eef0c186ef1d0547febb1dd6325 100644 (file)
--- a/WebCore/khtml/html/htmltokenizer.h
+++ b/WebCore/khtml/html/htmltokenizer.h
@@ -370,8 +370,8 @@ protected:
     KCharsets *charsets;
     KHTMLParser *parser;
 
-    KHTMLView *view;
-
+    QGuardedPtr<KHTMLView> view;
+    
 #ifndef NDEBUG
     bool inWrite;
 #endif

diff --git a/WebCore/khtml/khtml_part.cpp b/WebCore/khtml/khtml_part.cpp
index 9658ae55ea2741bf385e573304feb9517991302a..810127ef5f86034e812d9bcae4f961551c05f38a 100644 (file)
--- a/WebCore/khtml/khtml_part.cpp
+++ b/WebCore/khtml/khtml_part.cpp
@@ -578,7 +578,11 @@ void KHTMLPart::didExplicitOpen()
 
 
 bool KHTMLPart::closeURL()
-{
+{    
+    if (d->m_doc && d->m_doc->tokenizer()) {
+        d->m_doc->tokenizer()->stopParsing();
+    }
+    
   if ( d->m_job )
   {
     KHTMLPageCache::self()->cancelEntry(d->m_cacheId);

diff --git a/WebCore/khtml/xml/xml_tokenizer.cpp b/WebCore/khtml/xml/xml_tokenizer.cpp
index 199a790806f6028788499be88549e23fc452cfe0..a48b2f41baaa5a819fad21969fb7d46bb26fb6ff 100644 (file)
--- a/WebCore/khtml/xml/xml_tokenizer.cpp
+++ b/WebCore/khtml/xml/xml_tokenizer.cpp
@@ -2,7 +2,7 @@
  * This file is part of the DOM implementation for KDE.
  *
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
- * Copyright (C) 2004 Apple Computer, Inc.
+ * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -254,6 +254,10 @@ XMLTokenizer::XMLTokenizer(DocumentPtr *_doc, KHTMLView *_view)
 {
     if (m_doc)
         m_doc->ref();
+    
+    //FIXME: XMLTokenizer should use this in a fashion similiar to how
+    //HTMLTokenizer uses loadStopped, in the future.
+    loadStopped = false;
 }
 
 XMLTokenizer::~XMLTokenizer()

diff --git a/WebCore/khtml/xml/xml_tokenizer.h b/WebCore/khtml/xml/xml_tokenizer.h
index 473f3d74d47ebfbd95f23db8d9c2d3b2a5810a77..ec67140975a7ea5543f43382a10418197a960395 100644 (file)
--- a/WebCore/khtml/xml/xml_tokenizer.h
+++ b/WebCore/khtml/xml/xml_tokenizer.h
@@ -2,7 +2,7 @@
  * This file is part of the DOM implementation for KDE.
  *
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
- * Copyright (C) 2004 Apple Computer, Inc.
+ * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -57,10 +57,16 @@ public:
     virtual void finish() = 0;
     virtual void setOnHold(bool onHold) = 0;
     virtual bool isWaitingForScripts() const = 0;
+    void stopParsing() { loadStopped = true; }
 
     virtual void stopped() {};
     virtual bool processingData() const { return false; }
 
+    // The tokenizer has buffers which mean parsing can continue even after
+    // loading is supposed to be stopped. If the loading process has stopped,
+    // so should we. 
+    bool loadStopped;
+    
 #ifdef KHTML_XSLT
     virtual void setTransformSource(DOM::DocumentImpl* doc) {};
 #endif