<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[188358] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/188358">188358</a></dd>
<dt>Author</dt> <dd>antti@apple.com</dd>
<dt>Date</dt> <dd>2015-08-12 14:07:49 -0700 (Wed, 12 Aug 2015)</dd>
</dl>
<h3>Log Message</h3>
<pre>CachedResource leak in validation code
https://bugs.webkit.org/show_bug.cgi?id=147941
Reviewed by Chris Dumez.
Source/WebCore:
While adding test coverage I discovered a way to hit ASSERT(!resource->m_proxyResource) in CachedResource::setResourceToRevalidate.
I think this ends up leaking a resource too.
Test: http/tests/cache/recursive-validation.html
* loader/cache/CachedRawResource.cpp:
(WebCore::CachedRawResource::didAddClient):
Tighten the condition.
* loader/cache/CachedResource.cpp:
(WebCore::CachedResource::setResourceToRevalidate):
(WebCore::CachedResource::clearResourceToRevalidate):
Replace workaround for this bug with an assert.
* loader/cache/CachedResource.h:
(WebCore::CachedResource::validationInProgress):
(WebCore::CachedResource::validationCompleting):
(WebCore::CachedResource::didSendData):
* loader/cache/CachedResourceLoader.cpp:
(WebCore::CachedResourceLoader::revalidateResource):
(WebCore::CachedResourceLoader::determineRevalidationPolicy):
Fix the bug by using (instead of revalidating) resource that we are just finishing revalidating.
This can happen when a succesful revalidation synchronously triggers another load for the same resource.
LayoutTests:
* http/tests/cache/recursive-validation.html: Added.
* http/tests/cache/resources/no-cache-with-validation.php: Added.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreloadercacheCachedRawResourcecpp">trunk/Source/WebCore/loader/cache/CachedRawResource.cpp</a></li>
<li><a href="#trunkSourceWebCoreloadercacheCachedResourcecpp">trunk/Source/WebCore/loader/cache/CachedResource.cpp</a></li>
<li><a href="#trunkSourceWebCoreloadercacheCachedResourceh">trunk/Source/WebCore/loader/cache/CachedResource.h</a></li>
<li><a href="#trunkSourceWebCoreloadercacheCachedResourceLoadercpp">trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestshttptestscacherecursivevalidationexpectedtxt">trunk/LayoutTests/http/tests/cache/recursive-validation-expected.txt</a></li>
<li><a href="#trunkLayoutTestshttptestscacherecursivevalidationhtml">trunk/LayoutTests/http/tests/cache/recursive-validation.html</a></li>
<li><a href="#trunkLayoutTestshttptestscacheresourcesnocachewithvalidationphp">trunk/LayoutTests/http/tests/cache/resources/no-cache-with-validation.php</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (188357 => 188358)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2015-08-12 21:01:15 UTC (rev 188357)
+++ trunk/LayoutTests/ChangeLog 2015-08-12 21:07:49 UTC (rev 188358)
</span><span class="lines">@@ -1,3 +1,13 @@
</span><ins>+2015-08-12 Antti Koivisto <antti@apple.com>
+
+ CachedResource leak in validation code
+ https://bugs.webkit.org/show_bug.cgi?id=147941
+
+ Reviewed by Chris Dumez.
+
+ * http/tests/cache/recursive-validation.html: Added.
+ * http/tests/cache/resources/no-cache-with-validation.php: Added.
+
</ins><span class="cx"> 2015-08-12 Joseph Pecoraro <pecoraro@apple.com>
</span><span class="cx">
</span><span class="cx"> Web Inspector: Not receiving responses for async request IndexedDB.requestDatabaseNames
</span></span></pre></div>
<a id="trunkLayoutTestshttptestscacherecursivevalidationexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/http/tests/cache/recursive-validation-expected.txt (0 => 188358)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/cache/recursive-validation-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/cache/recursive-validation-expected.txt 2015-08-12 21:07:49 UTC (rev 188358)
</span><span class="lines">@@ -0,0 +1,9 @@
</span><ins>+Test that recursively loading resource that requires validation does not assert or crash
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestshttptestscacherecursivevalidationhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/http/tests/cache/recursive-validation.html (0 => 188358)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/cache/recursive-validation.html (rev 0)
+++ trunk/LayoutTests/http/tests/cache/recursive-validation.html 2015-08-12 21:07:49 UTC (rev 188358)
</span><span class="lines">@@ -0,0 +1,24 @@
</span><ins>+<script src="/js-test-resources/js-test-pre.js"></script>
+<script>
+jsTestIsAsync = true;
+
+description("Test that recursively loading resource that requires validation does not assert or crash");
+
+function load(completion) {
+ var xhr = new XMLHttpRequest();
+ xhr.open('GET', "resources/no-cache-with-validation.php");
+ xhr.onload = completion;
+ xhr.send();
+}
+
+window.onload = load(function () {
+ load(function () {
+ load(function () {
+ load(function () {
+ finishJSTest();
+ });
+ });
+ });
+});
+</script>
+<script src="/js-test-resources/js-test-post.js"></script>
</ins></span></pre></div>
<a id="trunkLayoutTestshttptestscacheresourcesnocachewithvalidationphp"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/http/tests/cache/resources/no-cache-with-validation.php (0 => 188358)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/cache/resources/no-cache-with-validation.php (rev 0)
+++ trunk/LayoutTests/http/tests/cache/resources/no-cache-with-validation.php 2015-08-12 21:07:49 UTC (rev 188358)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+<?php
+if ($_SERVER["HTTP_IF_MODIFIED_SINCE"]) {
+ header("HTTP/1.0 304 Not Modified");
+ exit();
+}
+header("Cache-control: no-cache");
+header("Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT");
+header("Content-Type: text/plain");
+?>
+foo
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (188357 => 188358)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2015-08-12 21:01:15 UTC (rev 188357)
+++ trunk/Source/WebCore/ChangeLog 2015-08-12 21:07:49 UTC (rev 188358)
</span><span class="lines">@@ -1,3 +1,37 @@
</span><ins>+2015-08-12 Antti Koivisto <antti@apple.com>
+
+ CachedResource leak in validation code
+ https://bugs.webkit.org/show_bug.cgi?id=147941
+
+ Reviewed by Chris Dumez.
+
+ While adding test coverage I discovered a way to hit ASSERT(!resource->m_proxyResource) in CachedResource::setResourceToRevalidate.
+ I think this ends up leaking a resource too.
+
+ Test: http/tests/cache/recursive-validation.html
+
+ * loader/cache/CachedRawResource.cpp:
+ (WebCore::CachedRawResource::didAddClient):
+
+ Tighten the condition.
+
+ * loader/cache/CachedResource.cpp:
+ (WebCore::CachedResource::setResourceToRevalidate):
+ (WebCore::CachedResource::clearResourceToRevalidate):
+
+ Replace workaround for this bug with an assert.
+
+ * loader/cache/CachedResource.h:
+ (WebCore::CachedResource::validationInProgress):
+ (WebCore::CachedResource::validationCompleting):
+ (WebCore::CachedResource::didSendData):
+ * loader/cache/CachedResourceLoader.cpp:
+ (WebCore::CachedResourceLoader::revalidateResource):
+ (WebCore::CachedResourceLoader::determineRevalidationPolicy):
+
+ Fix the bug by using (instead of revalidating) resource that we are just finishing revalidating.
+ This can happen when a succesful revalidation synchronously triggers another load for the same resource.
+
</ins><span class="cx"> 2015-08-12 Matthew Daiter <mdaiter@apple.com>
</span><span class="cx">
</span><span class="cx"> Need to add stubs to enumerateDevices
</span></span></pre></div>
<a id="trunkSourceWebCoreloadercacheCachedRawResourcecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/cache/CachedRawResource.cpp (188357 => 188358)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/cache/CachedRawResource.cpp 2015-08-12 21:01:15 UTC (rev 188357)
+++ trunk/Source/WebCore/loader/cache/CachedRawResource.cpp 2015-08-12 21:07:49 UTC (rev 188358)
</span><span class="lines">@@ -141,10 +141,12 @@
</span><span class="cx">
</span><span class="cx"> if (!m_response.isNull()) {
</span><span class="cx"> ResourceResponse response(m_response);
</span><del>- if (validationInProgress())
</del><ins>+ if (validationCompleting())
</ins><span class="cx"> response.setSource(ResourceResponse::Source::MemoryCacheAfterValidation);
</span><del>- else
</del><ins>+ else {
+ ASSERT(!validationInProgress());
</ins><span class="cx"> response.setSource(ResourceResponse::Source::MemoryCache);
</span><ins>+ }
</ins><span class="cx"> client->responseReceived(this, response);
</span><span class="cx"> }
</span><span class="cx"> if (!hasClient(c))
</span></span></pre></div>
<a id="trunkSourceWebCoreloadercacheCachedResourcecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/cache/CachedResource.cpp (188357 => 188358)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/cache/CachedResource.cpp 2015-08-12 21:01:15 UTC (rev 188357)
+++ trunk/Source/WebCore/loader/cache/CachedResource.cpp 2015-08-12 21:07:49 UTC (rev 188358)
</span><span class="lines">@@ -592,29 +592,25 @@
</span><span class="cx"> ASSERT(resource != this);
</span><span class="cx"> ASSERT(m_handlesToRevalidate.isEmpty());
</span><span class="cx"> ASSERT(resource->type() == type());
</span><ins>+ ASSERT(!resource->m_proxyResource);
</ins><span class="cx">
</span><span class="cx"> LOG(ResourceLoading, "CachedResource %p setResourceToRevalidate %p", this, resource);
</span><span class="cx">
</span><del>- // The following assert should be investigated whenever it occurs. Although it should never fire, it currently does in rare circumstances.
- // https://bugs.webkit.org/show_bug.cgi?id=28604.
- // So the code needs to be robust to this assert failing thus the "if (m_resourceToRevalidate->m_proxyResource == this)" in CachedResource::clearResourceToRevalidate.
- ASSERT(!resource->m_proxyResource);
-
</del><span class="cx"> resource->m_proxyResource = this;
</span><span class="cx"> m_resourceToRevalidate = resource;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void CachedResource::clearResourceToRevalidate()
</span><del>-{
</del><ins>+{
</ins><span class="cx"> ASSERT(m_resourceToRevalidate);
</span><ins>+ ASSERT(m_resourceToRevalidate->m_proxyResource == this);
+
</ins><span class="cx"> if (m_switchingClientsToRevalidatedResource)
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- // A resource may start revalidation before this method has been called, so check that this resource is still the proxy resource before clearing it out.
- if (m_resourceToRevalidate->m_proxyResource == this) {
- m_resourceToRevalidate->m_proxyResource = 0;
- m_resourceToRevalidate->deleteIfPossible();
- }
</del><ins>+ m_resourceToRevalidate->m_proxyResource = nullptr;
+ m_resourceToRevalidate->deleteIfPossible();
+
</ins><span class="cx"> m_handlesToRevalidate.clear();
</span><span class="cx"> m_resourceToRevalidate = 0;
</span><span class="cx"> deleteIfPossible();
</span></span></pre></div>
<a id="trunkSourceWebCoreloadercacheCachedResourceh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/cache/CachedResource.h (188357 => 188358)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/cache/CachedResource.h 2015-08-12 21:01:15 UTC (rev 188357)
+++ trunk/Source/WebCore/loader/cache/CachedResource.h 2015-08-12 21:07:49 UTC (rev 188358)
</span><span class="lines">@@ -245,6 +245,7 @@
</span><span class="cx"> void clearResourceToRevalidate();
</span><span class="cx"> void updateResponseAfterRevalidation(const ResourceResponse& validatingResponse);
</span><span class="cx"> bool validationInProgress() const { return m_proxyResource; }
</span><ins>+ bool validationCompleting() const { return m_proxyResource && m_proxyResource->m_switchingClientsToRevalidatedResource; }
</ins><span class="cx">
</span><span class="cx"> virtual void didSendData(unsigned long long /* bytesSent */, unsigned long long /* totalBytesToBeSent */) { }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCoreloadercacheCachedResourceLoadercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp (188357 => 188358)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp 2015-08-12 21:01:15 UTC (rev 188357)
+++ trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp 2015-08-12 21:07:49 UTC (rev 188358)
</span><span class="lines">@@ -605,7 +605,7 @@
</span><span class="cx"> ASSERT(resource->sessionID() == sessionID());
</span><span class="cx">
</span><span class="cx"> CachedResourceHandle<CachedResource> newResource = createResource(resource->type(), resource->resourceRequest(), resource->encoding(), resource->sessionID());
</span><del>-
</del><ins>+
</ins><span class="cx"> LOG(ResourceLoading, "Resource %p created to revalidate %p", newResource.get(), resource);
</span><span class="cx"> newResource->setResourceToRevalidate(resource);
</span><span class="cx">
</span><span class="lines">@@ -711,10 +711,15 @@
</span><span class="cx"> if (m_allowStaleResources)
</span><span class="cx"> return Use;
</span><span class="cx">
</span><del>- // Alwaus use preloads.
</del><ins>+ // Always use preloads.
</ins><span class="cx"> if (existingResource->isPreloaded())
</span><span class="cx"> return Use;
</span><span class="cx">
</span><ins>+ // We can find resources that are being validated from cache only when validation is just successfully completing.
+ if (existingResource->validationCompleting())
+ return Use;
+ ASSERT(!existingResource->validationInProgress());
+
</ins><span class="cx"> // Validate the redirect chain.
</span><span class="cx"> bool cachePolicyIsHistoryBuffer = cachePolicy(type) == CachePolicyHistoryBuffer;
</span><span class="cx"> if (!existingResource->redirectChainAllowsReuse(cachePolicyIsHistoryBuffer ? ReuseExpiredRedirection : DoNotReuseExpiredRedirection)) {
</span></span></pre>
</div>
</div>
</body>
</html>