<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[204777] releases/WebKitGTK/webkit-2.12</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/204777">204777</a></dd>
<dt>Author</dt> <dd>carlosgc@webkit.org</dd>
<dt>Date</dt> <dd>2016-08-23 01:22:25 -0700 (Tue, 23 Aug 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/202769">r202769</a> - prepareForDestruction() always needs to be called before destroying the Document object.
https://bugs.webkit.org/show_bug.cgi?id=159372
rdar://problem/26788150
Reviewed by Antti Koivisto.
We should never start destroying the Document object without calling prepareForDestruction() first.
It ensures that render tree gets nuked before we start tearing down the node tree.
Source/WebCore:
Test: fast/history/page-cache-destroy-document.html
* dom/Document.cpp:
(WebCore::Document::removedLastRef):
LayoutTests:
* fast/history/page-cache-destroy-document-expected.txt: Added.
* fast/history/page-cache-destroy-document.html: Added.
* fast/history/resources/page-cache-destroy-helper.html: Added.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsChangeLog">releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCoreChangeLog">releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCoredomDocumentcpp">releases/WebKitGTK/webkit-2.12/Source/WebCore/dom/Document.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCoredomDocumenth">releases/WebKitGTK/webkit-2.12/Source/WebCore/dom/Document.h</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsfasthistorypagecachedestroydocumentexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/fast/history/page-cache-destroy-document-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsfasthistorypagecachedestroydocumenthtml">releases/WebKitGTK/webkit-2.12/LayoutTests/fast/history/page-cache-destroy-document.html</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsfasthistoryresourcespagecachedestroyhelperhtml">releases/WebKitGTK/webkit-2.12/LayoutTests/fast/history/resources/page-cache-destroy-helper.html</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="releasesWebKitGTKwebkit212LayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog (204776 => 204777)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog 2016-08-23 07:35:25 UTC (rev 204776)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog 2016-08-23 08:22:25 UTC (rev 204777)
</span><span class="lines">@@ -1,3 +1,18 @@
</span><ins>+2016-07-01 Zalan Bujtas <zalan@apple.com>
+
+ prepareForDestruction() always needs to be called before destroying the Document object.
+ https://bugs.webkit.org/show_bug.cgi?id=159372
+ rdar://problem/26788150
+
+ Reviewed by Antti Koivisto.
+
+ We should never start destroying the Document object without calling prepareForDestruction() first.
+ It ensures that render tree gets nuked before we start tearing down the node tree.
+
+ * fast/history/page-cache-destroy-document-expected.txt: Added.
+ * fast/history/page-cache-destroy-document.html: Added.
+ * fast/history/resources/page-cache-destroy-helper.html: Added.
+
</ins><span class="cx"> 2016-06-20 Zalan Bujtas <zalan@apple.com>
</span><span class="cx">
</span><span class="cx"> Set the end position on the placeholder BidiRun properly.
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestsfasthistorypagecachedestroydocumentexpectedtxt"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.12/LayoutTests/fast/history/page-cache-destroy-document-expected.txt (0 => 204777)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/fast/history/page-cache-destroy-document-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/fast/history/page-cache-destroy-document-expected.txt 2016-08-23 08:22:25 UTC (rev 204777)
</span><span class="lines">@@ -0,0 +1 @@
</span><ins>+PASS if no crash in release.
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestsfasthistorypagecachedestroydocumenthtml"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.12/LayoutTests/fast/history/page-cache-destroy-document.html (0 => 204777)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/fast/history/page-cache-destroy-document.html (rev 0)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/fast/history/page-cache-destroy-document.html 2016-08-23 08:22:25 UTC (rev 204777)
</span><span class="lines">@@ -0,0 +1,37 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script>
+description('Tests that page can safely remove an iframe durin pagehide event.');
+if (window.testRunner) {
+ window.testRunner.overridePreference("WebKitUsesPageCachePreferenceKey", 1);
+ window.testRunner.waitUntilDone();
+}
+
+window.addEventListener("pagehide", function(event) {
+ debug("pagehide - entering cache");
+ debug("remove iframe");
+ var iframe = document.getElementById("removeThis");
+ iframe.parentNode.removeChild(iframe);
+ finishJSTest();
+ window.testRunner.notifyDone();
+}, false);
+
+function runTest() {
+ // Force a back navigation back to this page.
+ setTimeout(function() {
+ window.location.href = "resources/page-cache-destroy-helper.html";
+ }, 10);
+}
+
+var successfullyParsed = true;
+var jsTestIsAsync = true;
+</script>
+<iframe onload="runTest()" id=removeThis src="resources/dummy.html"></iframe>
+</body>
+</html>
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestsfasthistoryresourcespagecachedestroyhelperhtml"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.12/LayoutTests/fast/history/resources/page-cache-destroy-helper.html (0 => 204777)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/fast/history/resources/page-cache-destroy-helper.html (rev 0)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/fast/history/resources/page-cache-destroy-helper.html 2016-08-23 08:22:25 UTC (rev 204777)
</span><span class="lines">@@ -0,0 +1,8 @@
</span><ins>+PASS if no crash in release.
+<script>
+ window.addEventListener("load", function() {
+ setTimeout(function() {
+ history.back();
+ }, 0);
+ }, false);
+</script>
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog (204776 => 204777)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog 2016-08-23 07:35:25 UTC (rev 204776)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog 2016-08-23 08:22:25 UTC (rev 204777)
</span><span class="lines">@@ -1,3 +1,19 @@
</span><ins>+2016-07-01 Zalan Bujtas <zalan@apple.com>
+
+ prepareForDestruction() always needs to be called before destroying the Document object.
+ https://bugs.webkit.org/show_bug.cgi?id=159372
+ rdar://problem/26788150
+
+ Reviewed by Antti Koivisto.
+
+ We should never start destroying the Document object without calling prepareForDestruction() first.
+ It ensures that render tree gets nuked before we start tearing down the node tree.
+
+ Test: fast/history/page-cache-destroy-document.html
+
+ * dom/Document.cpp:
+ (WebCore::Document::removedLastRef):
+
</ins><span class="cx"> 2016-06-20 Zalan Bujtas <zalan@apple.com>
</span><span class="cx">
</span><span class="cx"> Set the end position on the placeholder BidiRun properly.
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCoredomDocumentcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/dom/Document.cpp (204776 => 204777)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/dom/Document.cpp 2016-08-23 07:35:25 UTC (rev 204776)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/dom/Document.cpp 2016-08-23 08:22:25 UTC (rev 204777)
</span><span class="lines">@@ -546,8 +546,6 @@
</span><span class="cx"> , m_cookieCacheExpiryTimer(*this, &Document::invalidateDOMCookieCache)
</span><span class="cx"> , m_disabledFieldsetElementsCount(0)
</span><span class="cx"> , m_hasInjectedPlugInsScript(false)
</span><del>- , m_renderTreeBeingDestroyed(false)
- , m_hasPreparedForDestruction(false)
</del><span class="cx"> , m_hasStyleWithViewportUnits(false)
</span><span class="cx"> {
</span><span class="cx"> allDocuments().add(this);
</span><span class="lines">@@ -680,6 +678,7 @@
</span><span class="cx"> // until after removeDetachedChildren returns, so we protect ourselves.
</span><span class="cx"> incrementReferencingNodeCount();
</span><span class="cx">
</span><ins>+ prepareForDestruction();
</ins><span class="cx"> // We must make sure not to be retaining any of our children through
</span><span class="cx"> // these extra pointers or we will create a reference cycle.
</span><span class="cx"> m_focusedElement = nullptr;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCoredomDocumenth"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/dom/Document.h (204776 => 204777)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/dom/Document.h 2016-08-23 07:35:25 UTC (rev 204776)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/dom/Document.h 2016-08-23 08:22:25 UTC (rev 204777)
</span><span class="lines">@@ -1759,8 +1759,8 @@
</span><span class="cx"> unsigned m_disabledFieldsetElementsCount;
</span><span class="cx">
</span><span class="cx"> bool m_hasInjectedPlugInsScript;
</span><del>- bool m_renderTreeBeingDestroyed;
- bool m_hasPreparedForDestruction;
</del><ins>+ bool m_renderTreeBeingDestroyed { false };
+ bool m_hasPreparedForDestruction { false };
</ins><span class="cx">
</span><span class="cx"> bool m_hasStyleWithViewportUnits;
</span><span class="cx"> bool m_isTimerThrottlingEnabled { false };
</span></span></pre>
</div>
</div>
</body>
</html>