git://git.webkit.org / WebKit-https.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: a94eaaf)
WebCore:
authorbdakin@apple.com <bdakin@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 19 Jan 2008 00:04:08 +0000 (00:04 +0000)
committerbdakin@apple.com <bdakin@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 19 Jan 2008 00:04:08 +0000 (00:04 +0000)
        Reviewed by Darin, landed by Beth.

        - fixed http://bugs.webkit.org/show_bug.cgi?id=15765

        The call to HTMLTokenizer::write might result in a call to ::end which will invoke
        HTMLParser::finished() or Document::finishedParsing(). HTMLParser::finished() will eventually
        call Document::finishedParsing. The Document will delete the calling HTMLTokenizer and from the deleted
        tokenizer we will call into FrameLoader::tokenizerProcessedData.
        -) FrameLoader::tokenizerProcessedData calls FrameLoader::checkCompleted which gets called from the Document::finishedParsing
           (FrameLoader::finishedParsing).

        * html/HTMLTokenizer.cpp:
        (WebCore::HTMLTokenizer::timerFired):

LayoutTests:

        Reviewed by Darin, landed by Beth.

        -test for http://bugs.webkit.org/show_bug.cgi?id=15765
        Gmail hitting an assert in FrameLoader::tokenizerProcessedData

        * http/tests/loading/gmail-assert-on-load-expected.txt: Added.
        * http/tests/loading/gmail-assert-on-load.html: Added.
        * http/tests/loading/resources/gmail-assert-on-load-frame.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@29655 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/http/tests/loading/gmail-assert-on-load-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/http/tests/loading/gmail-assert-on-load.html [new file with mode: 0644] patch | blob
LayoutTests/http/tests/loading/resources/gmail-assert-on-load-frame.html [new file with mode: 0644] patch | blob
WebCore/ChangeLog patch | blob | history
WebCore/html/HTMLTokenizer.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 65e1495c5f5faa054dbf0e7bb434d90558645f37..1bf00f28950c0dfeff4a858c6456782ed723c3d0 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2008-01-18  Holger Hans Peter Freyther  <holger.freyther@trolltech.com>
+
+        Reviewed by Darin, landed by Beth.
+
+        -test for http://bugs.webkit.org/show_bug.cgi?id=15765
+        Gmail hitting an assert in FrameLoader::tokenizerProcessedData
+
+        * http/tests/loading/gmail-assert-on-load-expected.txt: Added.
+        * http/tests/loading/gmail-assert-on-load.html: Added.
+        * http/tests/loading/resources/gmail-assert-on-load-frame.html: Added.
+
 2008-01-18  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Beth Dakin.
diff --git a/LayoutTests/http/tests/loading/gmail-assert-on-load-expected.txt b/LayoutTests/http/tests/loading/gmail-assert-on-load-expected.txt
new file mode 100644 (file)
index 0000000..74f847d
--- /dev/null
+++ b/LayoutTests/http/tests/loading/gmail-assert-on-load-expected.txt
@@ -0,0 +1,16 @@
+main frame - didStartProvisionalLoadForFrame
+main frame - willCloseFrame
+main frame - didCommitLoadForFrame
+main frame - didClearWindowObjectForFrame
+frame "<!--framePath //<!--frame0-->-->" - didStartProvisionalLoadForFrame
+main frame - didFinishDocumentLoadForFrame
+frame "<!--framePath //<!--frame0-->-->" - willCloseFrame
+frame "<!--framePath //<!--frame0-->-->" - didCommitLoadForFrame
+frame "<!--framePath //<!--frame0-->-->" - didClearWindowObjectForFrame
+main frame - didHandleOnloadEventsForFrame
+main frame - didFinishLoadForFrame
+This test provokes HTMLTokenizer::timerFired to be called and from within timerFired we want to call WebCore::pageDestroyed.
+
+You pass this test if you don't see an ASSERT. This is from http://bugs.webkit.org/show_bug.cgi?id=15765.
+
+
diff --git a/LayoutTests/http/tests/loading/gmail-assert-on-load.html b/LayoutTests/http/tests/loading/gmail-assert-on-load.html
new file mode 100644 (file)
index 0000000..211264b
--- /dev/null
+++ b/LayoutTests/http/tests/loading/gmail-assert-on-load.html
@@ -0,0 +1,11 @@
+<html>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+}
+</script>
+<body>
+<p>This test provokes HTMLTokenizer::timerFired to be called and from within timerFired we want to call WebCore::pageDestroyed.</p>
+<p>You pass this test if you don't see an ASSERT. This is from http://bugs.webkit.org/show_bug.cgi?id=15765.</p>
+<iframe src="resources/gmail-assert-on-load-frame.html"></iframe>
+</body>
diff --git a/LayoutTests/http/tests/loading/resources/gmail-assert-on-load-frame.html b/LayoutTests/http/tests/loading/resources/gmail-assert-on-load-frame.html
new file mode 100644 (file)
index 0000000..c204fa7
--- /dev/null
+++ b/LayoutTests/http/tests/loading/resources/gmail-assert-on-load-frame.html
@@ -0,0 +1,20 @@
+<script>
+function destroyIt() {
+    frameElement.parentNode.removeChild(frameElement);
+}
+</script>
+<script>
+  // Force a sleep for 1 second, to make sure the rest of the parsing is done
+  // via a timer.
+  var start = new Date()
+  var startMS = start.getTime()
+  while (true) {
+    var now = new Date()
+    if (now.getTime() - startMS > 1000) {
+      break;
+    }
+  }
+</script>
+
+<body onload="destroyIt()">
+</body>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 5080b0879d367b5b47f52825cfdcd960fe7661fb..f709eac247a60602a5660f2fd9e6eea400874e6a 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2008-01-18  Holger Hans Peter Freyther  <holger.freyther@trolltech.com>
+
+        Reviewed by Darin, landed by Beth.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=15765
+
+        The call to HTMLTokenizer::write might result in a call to ::end which will invoke
+        HTMLParser::finished() or Document::finishedParsing(). HTMLParser::finished() will eventually
+        call Document::finishedParsing. The Document will delete the calling HTMLTokenizer and from the deleted
+        tokenizer we will call into FrameLoader::tokenizerProcessedData.
+        -) FrameLoader::tokenizerProcessedData calls FrameLoader::checkCompleted which gets called from the Document::finishedParsing
+           (FrameLoader::finishedParsing).
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::timerFired):
+
 2008-01-18  David Hyatt  <hyatt@apple.com>
 
         Don't apply the border/margin/padding check to root line boxes, since their renderers
diff --git a/WebCore/html/HTMLTokenizer.cpp b/WebCore/html/HTMLTokenizer.cpp
index cc8e265e1928e09dff8687860d78f18534b43a0d..f8cc543947d57ed847a359a762baff9aa6e1d76e 100644 (file)
--- a/WebCore/html/HTMLTokenizer.cpp
+++ b/WebCore/html/HTMLTokenizer.cpp
@@ -1529,15 +1529,9 @@ void HTMLTokenizer::timerFired(Timer<HTMLTokenizer>*)
         m_timer.startOneShot(0);
         return;
     }
-    
-    RefPtr<Frame> frame = m_fragment ? 0 : m_doc->frame();
 
-    // Invoke write() as though more data came in.
-    bool didCallEnd = write(SegmentedString(), true);
-  
-    // If we called end() during the write,  we need to let WebKit know that we're done processing the data.
-    if (didCallEnd && frame)
-        frame->loader()->tokenizerProcessedData();
+    // Invoke write() as though more data came in. This might cause us to get deleted.
+    write(SegmentedString(), true);
 }
 
 void HTMLTokenizer::end()
Mirror of the WebKit open source project from svn.webkit.org.