<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[209787] trunk/Source/WebCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/209787">209787</a></dd>
<dt>Author</dt> <dd>cdumez@apple.com</dd>
<dt>Date</dt> <dd>2016-12-13 18:39:57 -0800 (Tue, 13 Dec 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Make Document a FrameDestructionObserver
https://bugs.webkit.org/show_bug.cgi?id=165810
<rdar://problem/29157645>
Reviewed by Ryosuke Niwa.
Make Document a FrameDestructionObserver to make sure Document::m_frame
is properly nulled out when a Frame gets destroyed.
Document::disconnectFromFrame() is supposed to be called before the Frame
gets destroyed so this also adds an assertion to try and identify places
where we fail to call it.
No new tests, no known reproduction case.
* dom/Document.cpp:
(WebCore::Document::Document):
(WebCore::Document::disconnectFromFrame):
(WebCore::Document::frameDestroyed):
* dom/Document.h:
(WebCore::Document::frame): Deleted.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoredomDocumentcpp">trunk/Source/WebCore/dom/Document.cpp</a></li>
<li><a href="#trunkSourceWebCoredomDocumenth">trunk/Source/WebCore/dom/Document.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (209786 => 209787)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2016-12-14 02:39:39 UTC (rev 209786)
+++ trunk/Source/WebCore/ChangeLog 2016-12-14 02:39:57 UTC (rev 209787)
</span><span class="lines">@@ -1,3 +1,26 @@
</span><ins>+2016-12-13 Chris Dumez <cdumez@apple.com>
+
+ Make Document a FrameDestructionObserver
+ https://bugs.webkit.org/show_bug.cgi?id=165810
+ <rdar://problem/29157645>
+
+ Reviewed by Ryosuke Niwa.
+
+ Make Document a FrameDestructionObserver to make sure Document::m_frame
+ is properly nulled out when a Frame gets destroyed.
+ Document::disconnectFromFrame() is supposed to be called before the Frame
+ gets destroyed so this also adds an assertion to try and identify places
+ where we fail to call it.
+
+ No new tests, no known reproduction case.
+
+ * dom/Document.cpp:
+ (WebCore::Document::Document):
+ (WebCore::Document::disconnectFromFrame):
+ (WebCore::Document::frameDestroyed):
+ * dom/Document.h:
+ (WebCore::Document::frame): Deleted.
+
</ins><span class="cx"> 2016-12-13 Joseph Pecoraro <pecoraro@apple.com>
</span><span class="cx">
</span><span class="cx"> REGRESSION(r204163): Web Inspector: Page crashes when Inspector tries to load insecure SourceMap
</span></span></pre></div>
<a id="trunkSourceWebCoredomDocumentcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Document.cpp (209786 => 209787)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Document.cpp 2016-12-14 02:39:39 UTC (rev 209786)
+++ trunk/Source/WebCore/dom/Document.cpp 2016-12-14 02:39:57 UTC (rev 209787)
</span><span class="lines">@@ -431,6 +431,7 @@
</span><span class="cx"> Document::Document(Frame* frame, const URL& url, unsigned documentClasses, unsigned constructionFlags)
</span><span class="cx"> : ContainerNode(*this, CreateDocument)
</span><span class="cx"> , TreeScope(*this)
</span><ins>+ , FrameDestructionObserver(frame)
</ins><span class="cx"> #if ENABLE(IOS_TOUCH_EVENTS)
</span><span class="cx"> , m_touchEventsChangedTimer(*this, &Document::touchEventsChangedTimerFired)
</span><span class="cx"> #endif
</span><span class="lines">@@ -439,7 +440,6 @@
</span><span class="cx"> , m_needsNotifyRemoveAllPendingStylesheet(false)
</span><span class="cx"> , m_ignorePendingStylesheets(false)
</span><span class="cx"> , m_pendingSheetLayout(NoLayoutWithPendingSheets)
</span><del>- , m_frame(frame)
</del><span class="cx"> , m_cachedResourceLoader(m_frame ? Ref<CachedResourceLoader>(m_frame->loader().activeDocumentLoader()->cachedResourceLoader()) : CachedResourceLoader::create(nullptr))
</span><span class="cx"> , m_activeParserCount(0)
</span><span class="cx"> , m_wellFormed(false)
</span><span class="lines">@@ -2203,9 +2203,16 @@
</span><span class="cx">
</span><span class="cx"> void Document::disconnectFromFrame()
</span><span class="cx"> {
</span><del>- m_frame = nullptr;
</del><ins>+ observeFrame(nullptr);
</ins><span class="cx"> }
</span><span class="cx">
</span><ins>+void Document::frameDestroyed()
+{
+ // disconnectFromFrame() must be called before destroying the Frame.
+ ASSERT_WITH_SECURITY_IMPLICATION(!m_frame);
+ FrameDestructionObserver::frameDestroyed();
+}
+
</ins><span class="cx"> void Document::destroyRenderTree()
</span><span class="cx"> {
</span><span class="cx"> ASSERT(hasLivingRenderTree());
</span></span></pre></div>
<a id="trunkSourceWebCoredomDocumenth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Document.h (209786 => 209787)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Document.h 2016-12-14 02:39:39 UTC (rev 209786)
+++ trunk/Source/WebCore/dom/Document.h 2016-12-14 02:39:57 UTC (rev 209787)
</span><span class="lines">@@ -35,6 +35,7 @@
</span><span class="cx"> #include "ExceptionOr.h"
</span><span class="cx"> #include "FocusDirection.h"
</span><span class="cx"> #include "FontSelectorClient.h"
</span><ins>+#include "FrameDestructionObserver.h"
</ins><span class="cx"> #include "MediaProducer.h"
</span><span class="cx"> #include "MutationObserver.h"
</span><span class="cx"> #include "PageVisibilityState.h"
</span><span class="lines">@@ -286,6 +287,7 @@
</span><span class="cx"> , public TreeScope
</span><span class="cx"> , public ScriptExecutionContext
</span><span class="cx"> , public FontSelectorClient
</span><ins>+ , public FrameDestructionObserver
</ins><span class="cx"> , public Supplementable<Document> {
</span><span class="cx"> public:
</span><span class="cx"> static Ref<Document> create(Frame* frame, const URL& url)
</span><span class="lines">@@ -512,7 +514,6 @@
</span><span class="cx"> void setStateForNewFormElements(const Vector<String>&);
</span><span class="cx">
</span><span class="cx"> WEBCORE_EXPORT FrameView* view() const; // can be NULL
</span><del>- Frame* frame() const { return m_frame; } // can be NULL
</del><span class="cx"> WEBCORE_EXPORT Page* page() const; // can be NULL
</span><span class="cx"> WEBCORE_EXPORT Settings* settings() const; // can be NULL
</span><span class="cx">
</span><span class="lines">@@ -1312,6 +1313,7 @@
</span><span class="cx"> friend class IgnoreOpensDuringUnloadCountIncrementer;
</span><span class="cx">
</span><span class="cx"> void updateTitleElement(Element* newTitleElement);
</span><ins>+ void frameDestroyed() final;
</ins><span class="cx">
</span><span class="cx"> void commonTeardown();
</span><span class="cx">
</span><span class="lines">@@ -1410,7 +1412,6 @@
</span><span class="cx"> // do eventually load.
</span><span class="cx"> PendingSheetLayout m_pendingSheetLayout;
</span><span class="cx">
</span><del>- Frame* m_frame;
</del><span class="cx"> RefPtr<DOMWindow> m_domWindow;
</span><span class="cx"> WeakPtr<Document> m_contextDocument;
</span><span class="cx">
</span></span></pre>
</div>
</div>
</body>
</html>