Attachment 342839 Details for Bug 186688 – Patch

[patch] Patch

bug-186688-20180615130916.patch (text/plain), 1.83 KB, created by Chris Dumez on 2018-06-15 13:09:16 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Dumez

Created: 2018-06-15 13:09:16 PDT

Size: 1.83 KB

patch

obsolete

>Subversion Revision: 232885
>diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
>index afd1b268d3cda0061d370c03b044bee13866534e..0d3a6682c9f140b4c76c753c1fe8b02e8c9ec13b 100644
>--- a/Source/WebKit/ChangeLog
>+++ b/Source/WebKit/ChangeLog
>@@ -1,3 +1,19 @@
>+2018-06-15  Chris Dumez  <cdumez@apple.com>
>+
>+        Crash under SuspendedPageProxy::~SuspendedPageProxy()
>+        https://bugs.webkit.org/show_bug.cgi?id=186688
>+        <rdar://problem/41060769>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Ref the WebProcessProxy before calling suspendedPageWasDestroyed() on it as this
>+        might cause the WebProcessProxy / WebProcessPool to get destroyed otherwise, and
>+        we would crash trying to call unregisterSuspendedPageProxy() on the WebProcessPool
>+        on the next line.
>+
>+        * UIProcess/SuspendedPageProxy.cpp:
>+        (WebKit::SuspendedPageProxy::~SuspendedPageProxy):
>+
> 2018-06-15  Per Arne Vollan  <pvollan@apple.com>
> 
>         DisplayRefreshMonitorMac should hold a weak pointer to WebPage.
>diff --git a/Source/WebKit/UIProcess/SuspendedPageProxy.cpp b/Source/WebKit/UIProcess/SuspendedPageProxy.cpp
>index 2664d9ff1e7adc6f75c3cfffeda5c7d11cc394be..a1550cc384ae0ac15690a4864d1b154b74a163fe 100644
>--- a/Source/WebKit/UIProcess/SuspendedPageProxy.cpp
>+++ b/Source/WebKit/UIProcess/SuspendedPageProxy.cpp
>@@ -87,9 +87,9 @@ SuspendedPageProxy::SuspendedPageProxy(WebPageProxy& page, WebProcessProxy& proc
> 
> SuspendedPageProxy::~SuspendedPageProxy()
> {
>-    if (m_process) {
>-        m_process->suspendedPageWasDestroyed(*this);
>-        m_process->processPool().unregisterSuspendedPageProxy(*this);
>+    if (auto process = makeRefPtr(m_process)) {
>+        process->suspendedPageWasDestroyed(*this);
>+        process->processPool().unregisterSuspendedPageProxy(*this);
>     }
> 
>     m_backForwardListItem->setSuspendedPage(nullptr);

Actions: View | Formatted Diff | Diff

Attachments on bug 186688: 342839