Fix a crash due to m_resource being released while SubresourceLoader::didFinishLoading is executing (issue #439).

git-svn-id: https://chromiumembedded.googlecode.com/svn/trunk@398 5089003a-bbd8-11dd-ad1f-f1f9622dbc98
This commit is contained in:
Marshall Greenblatt 2011-11-29 16:38:31 +00:00
parent d351bc538c
commit dd144bf903
3 changed files with 21 additions and 1 deletions

View File

@ -23,9 +23,14 @@ patches = [
}, },
{ {
# https://bugs.webkit.org/show_bug.cgi?id=73273 # https://bugs.webkit.org/show_bug.cgi?id=73273
'name': 'v8_custom', 'name': 'webcore_v8_custom',
'path': '../third_party/WebKit/Source/WebCore/bindings/v8/custom/' 'path': '../third_party/WebKit/Source/WebCore/bindings/v8/custom/'
}, },
{
# https://bugs.webkit.org/show_bug.cgi?id=73325
'name': 'webcore_subresloader',
'path': '../third_party/WebKit/Source/WebCore/loader/',
},
{ {
# http://code.google.com/p/chromiumembedded/issues/detail?id=364 # http://code.google.com/p/chromiumembedded/issues/detail?id=364
'name': 'spi_webcore_364', 'name': 'spi_webcore_364',

View File

@ -0,0 +1,15 @@
Index: SubresourceLoader.cpp
===================================================================
--- SubresourceLoader.cpp (revision 100508)
+++ SubresourceLoader.cpp (working copy)
@@ -239,6 +239,10 @@
LOG(ResourceLoading, "Received '%s'.", m_resource->url().string().latin1().data());
RefPtr<SubresourceLoader> protect(this);
+ // If a load is canceled m_resource might be released in the call hierarchy originating
+ // from m_resource->data(). This causes the subsequent call to m_reosurce->finish() to crash
+ // unless m_resource is protected.
+ CachedResourceHandle<CachedResource> protect_res(m_resource);
m_state = Finishing;
m_resource->setLoadFinishTime(finishTime);
m_resource->data(resourceData(), true);