Add assertion to help track down WebCore::DocumentLoader::stopLoadingForPolicyChange...

https://bugs.webkit.org/show_bug.cgi?id=141441
<rdar://problem/13811738>

Reviewed by Alexey Proskuryakov.

Add assertion to help track down a crash in
WebCore::DocumentLoader::stopLoadingForPolicyChange().

* loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::~DocumentLoader):
Make sure the DocumentLoader is not waiting for a content policy
response when it is destroyed. If this were to happen, then the
lambda function passed to PolicyChecker::checkContentPolicy()
would outlive the DocumentLoader. This is an issue because
that lambda function captures [this], which is the DocumentLoader.
This would cause DocumentLoader::continueAfterContentPolicy() to
be called after the DocumentLoader has been destroyed, which would
explain the crash.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@179880 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index b7affa0c741a118750fb4d2277595cf05f18c1a1..755db815f7222f13619d2ea27b5450d3ceb6c69d 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,25 @@
+2015-02-10  Chris Dumez  <cdumez@apple.com>
+
+        Add assertion to help track down WebCore::DocumentLoader::stopLoadingForPolicyChange() crash
+        https://bugs.webkit.org/show_bug.cgi?id=141441
+        <rdar://problem/13811738>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add assertion to help track down a crash in
+        WebCore::DocumentLoader::stopLoadingForPolicyChange().
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::~DocumentLoader):
+        Make sure the DocumentLoader is not waiting for a content policy
+        response when it is destroyed. If this were to happen, then the
+        lambda function passed to PolicyChecker::checkContentPolicy()
+        would outlive the DocumentLoader. This is an issue because
+        that lambda function captures [this], which is the DocumentLoader.
+        This would cause DocumentLoader::continueAfterContentPolicy() to
+        be called after the DocumentLoader has been destroyed, which would
+        explain the crash.
+
 2015-02-07  Zalan Bujtas  <zalan@apple.com>
 
         REGRESSION (r168046): Crash in WebCore::InlineBox::renderer / WebCore::RenderFlowThread::checkLinesConsistency

diff --git a/Source/WebCore/loader/DocumentLoader.cpp b/Source/WebCore/loader/DocumentLoader.cpp
index 63d5e3a69045fe8824738221ec21607045c8a052..0b0968c35d49b8427d9e2ba01abbc5e8441f4ae6 100644 (file)
--- a/Source/WebCore/loader/DocumentLoader.cpp
+++ b/Source/WebCore/loader/DocumentLoader.cpp
@@ -161,6 +161,7 @@ ResourceLoader* DocumentLoader::mainResourceLoader() const
 DocumentLoader::~DocumentLoader()
 {
     ASSERT(!m_frame || frameLoader()->activeDocumentLoader() != this || !isLoading());
+    ASSERT(!m_waitingForContentPolicy);
     if (m_iconLoadDecisionCallback)
         m_iconLoadDecisionCallback->invalidate();
     if (m_iconDataCallback)