Commit 0c815c0c authored by ap@webkit.org's avatar ap@webkit.org

Reviewed by Darin Adler.

        https://bugs.webkit.org/show_bug.cgi?id=22200
        Crash when close event is dispatched to MessagePort due to document destruction

        Test: fast/events/message-port-onclose.html

        * dom/MessagePort.cpp: (WebCore::MessagePort::contextDestroyed):
        Don't dispatch close event, even though HTML5 currently says that we should. It is not
        right for GC to have observable effects.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@38366 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 3568f13c
2008-11-12 Alexey Proskuryakov <ap@webkit.org>
Reviewed by Darin Adler.
https://bugs.webkit.org/show_bug.cgi?id=22200
Crash when close event is dispatched to MessagePort due to document destruction
* fast/events/message-port-onclose-expected.txt: Added.
* fast/events/message-port-onclose.html: Added.
* fast/events/resources/message-port-iframe.html:
Added more tests for close event dispatch.
2008-11-12 Dirk Schulze <vbs85@gmx.de>
Reviewed by Darin Adler.
......
Test that close event handler is invoked when a MessagePort is closed.
PASS
<body>
<p>Test that close event handler is invoked when a MessagePort is closed.</p>
<pre id=log></pre>
<script>
function gc()
{
if (window.GCController)
return GCController.collect();
for (var i = 0; i < 10000; i++) { // > force garbage collection (FF requires about 9K allocations before a collect)
var s = new String("abc");
}
}
function log(message)
{
document.getElementById("log").innerHTML += message + "<br>";
}
if (window.layoutTestController) {
layoutTestController.dumpAsText();
layoutTestController.waitUntilDone();
}
function test()
{
// Single frame.
var channel = new MessageChannel;
var closeCount = 0;
function onclose()
{
++closeCount;
if (closeCount == 4)
test2();
}
channel.port1.onclose = onclose;
channel.port2.onclose = onclose;
channel.port1.addEventListener("close", onclose, false);
channel.port2.addEventListener("close", onclose, false);
gc();
channel.port1.start();
channel.port2.start();
channel.port1.close();
}
function test2()
{
// Cross-frame.
var channel = new MessageChannel;
window.frames[0].postMessage("msg", channel.port2, "*");
var mainPort = channel.port1;
mainPort.start();
var closeCount = 0;
function onclose()
{
++closeCount;
if (closeCount == 2)
test3();
}
mainPort.postMessage("closePort");
mainPort.onclose = onclose;
mainPort.addEventListener("close", onclose, false);
gc();
}
function test3()
{
// Document destroyed.
var channel = new MessageChannel;
window.frames[0].postMessage("msg", channel.port2, "*");
var mainPort = channel.port1;
mainPort.start();
var closeCount = 0;
function onclose()
{
++closeCount;
log("FAIL: unexpected close event from document destruction.");
}
mainPort.postMessage("closeFrame");
mainPort.onclose = onclose;
mainPort.addEventListener("close", onclose, false);
setTimeout(function() {
if (closeCount == 0)
log("PASS");
if (window.layoutTestController)
layoutTestController.notifyDone();
}, 50);
gc();
}
</script>
<iframe src="resources/message-port-iframe.html" onload="test()"></iframe>
</body>
<script>
function gc()
{
if (window.GCController)
return GCController.collect();
for (var i = 0; i < 10000; i++) { // > force garbage collection (FF requires about 9K allocations before a collect)
var s = new String("abc");
}
}
var port;
function onMessage(evt) {
if (evt.data == "ping")
......@@ -14,6 +24,12 @@ function onMessage(evt) {
alert(evt.data.substr(6));
else if (evt.data == "freeze")
while (1) {}
else if (evt.data == "closePort")
this.close();
else if (evt.data == "closeFrame") {
frameElement.parentNode.removeChild(frameElement);
gc();
}
}
window.addEventListener("message", function(evt) {
......
2008-11-12 Alexey Proskuryakov <ap@webkit.org>
Reviewed by Darin Adler.
https://bugs.webkit.org/show_bug.cgi?id=22200
Crash when close event is dispatched to MessagePort due to document destruction
Test: fast/events/message-port-onclose.html
* dom/MessagePort.cpp: (WebCore::MessagePort::contextDestroyed):
Don't dispatch close event, even though HTML5 currently says that we should. It is not
right for GC to have observable effects.
2008-11-12 Alexey Proskuryakov <ap@webkit.org>
Reviewed by Darin Adler.
......@@ -211,12 +211,9 @@ void MessagePort::contextDestroyed()
{
ASSERT(m_scriptExecutionContext);
if (m_entangledPort) {
RefPtr<MessagePort> survivingPort = m_entangledPort;
if (m_entangledPort)
unentangle();
if (survivingPort->m_scriptExecutionContext != m_scriptExecutionContext) // Otherwise, survivingPort won't really survive.
survivingPort->queueCloseEvent();
}
m_scriptExecutionContext = 0;
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment