WebCore:
authorandersca <andersca@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 20 Oct 2006 21:53:01 +0000 (21:53 +0000)
committerandersca <andersca@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 20 Oct 2006 21:53:01 +0000 (21:53 +0000)
2006-10-20  Anders Carlsson  <acarlsson@apple.com>

        Reviewed by Geoff.

        * bindings/js/kjs_window.cpp:
        (KJS::Window::timerFired):
        Check if the timeout id is still in the table before trying to access it. If it isn't in the table
        it has been deleted inside of the execute method.

LayoutTests:

2006-10-20  Anders Carlsson  <acarlsson@apple.com>

        Reviewed by Goeff.

        Add test case for timer crash.

        * fast/dom/timer-clear-interval-in-handler-expected.txt: Added.
        * fast/dom/timer-clear-interval-in-handler.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@17173 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/dom/timer-clear-interval-in-handler-expected.txt [new file with mode: 0644]
LayoutTests/fast/dom/timer-clear-interval-in-handler.html [new file with mode: 0644]
WebCore/ChangeLog
WebCore/bindings/js/kjs_window.cpp

index 1852278c6d0d9e714149dc02d9d053e12655d5d4..9729163303e5c3ec63da0a425c8d5154cdfa8556 100644 (file)
@@ -1,3 +1,12 @@
+2006-10-20  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Gøff.
+
+        Add test case for timer crash.
+        
+        * fast/dom/timer-clear-interval-in-handler-expected.txt: Added.
+        * fast/dom/timer-clear-interval-in-handler.html: Added.
+
 2006-10-20  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Beth, approved in principle by Adele, who couldn't be troubled
diff --git a/LayoutTests/fast/dom/timer-clear-interval-in-handler-expected.txt b/LayoutTests/fast/dom/timer-clear-interval-in-handler-expected.txt
new file mode 100644 (file)
index 0000000..6b937ee
--- /dev/null
@@ -0,0 +1 @@
+This tests that removing an interval timer inside of its timeout handler does not cause a crash. Success, didn't crash!
diff --git a/LayoutTests/fast/dom/timer-clear-interval-in-handler.html b/LayoutTests/fast/dom/timer-clear-interval-in-handler.html
new file mode 100644 (file)
index 0000000..732cbba
--- /dev/null
@@ -0,0 +1,32 @@
+<html>
+<head>
+<script>
+    function timeoutHandler() {
+            // Invoke it a few times so that we get the nesting
+            count++;
+            
+            if (count > 10)  {
+                clearInterval(intervalID);
+                
+                if (window.layoutTestController)
+                    layoutTestController.notifyDone();
+            }
+        }
+
+    var intervalID;
+    var count = 0;
+
+    function runTests() {
+        if (window.layoutTestController) {
+            layoutTestController.dumpAsText()
+            layoutTestController.waitUntilDone();
+        }
+            
+        intervalID = setInterval(timeoutHandler, 1);
+    }
+    </script>
+</head>
+<body onload="runTests()">
+    This tests that removing an interval timer inside of its timeout handler does not cause a crash. Success, didn't crash!
+</body>
+</html>
index add98d213d9b26fd2f940b2bf79959cad5d3c247..e4145072c520b6a074d11a478f1023a7d16603a0 100644 (file)
@@ -1,3 +1,12 @@
+2006-10-20  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Geoff.
+
+        * bindings/js/kjs_window.cpp:
+        (KJS::Window::timerFired):
+        Check if the timeout id is still in the table before trying to access it. If it isn't in the table
+        it has been deleted inside of the execute method.
+
 2006-10-20  Anders Carlsson  <acarlsson@apple.com>
 
         Reviewed by Darin and Geoff.
index 04640ba4a71909d985cadbcd234d1e760a89e566..5028aba037eab419ab78fd088380f29094b28154 100644 (file)
@@ -1944,8 +1944,10 @@ void Window::timerFired(DOMWindowTimer* timer)
 {
     // Simple case for non-one-shot timers.
     if (timer->isActive()) {
+        int timeoutId = timer->timeoutId();
+
         timer->action()->execute(this);
-        if (timer->repeatInterval() && timer->repeatInterval() < cMinimumTimerInterval) {
+        if (m_timeouts.contains(timeoutId) && timer->repeatInterval() && timer->repeatInterval() < cMinimumTimerInterval) {
             timer->setNestingLevel(timer->nestingLevel() + 1);
             if (timer->nestingLevel() >= cMaxTimerNestingLevel)
                 timer->augmentRepeatInterval(cMinimumTimerInterval - timer->repeatInterval());