Skip to content

GitLab

T
tangled
Commit 4e060c0d authored by beidson@apple.com's avatar beidson@apple.com
Browse files
Options

Crash in Safari opening new tabs to "same page" 

<rdar://problem/7593857> and https://bugs.webkit.org/show_bug.cgi?id=34444

Reviewed by Adele Peterson.

WebCore: 

Test: fast/loader/crash-copying-backforwardlist.html

* loader/FrameLoader.cpp:
(WebCore::FrameLoader::loadItem): Null check currentItem().

* page/Page.cpp:
(WebCore::Page::goToItem): Ditto.

WebKitTools: 

Add a mode (Mac-only for now) that exercises the WebView SPI _loadBackForwardListFromOtherView:

* DumpRenderTree/LayoutTestController.cpp:
(LayoutTestController::LayoutTestController):
(setNewWindowsCopyBackForwardListCallback):
(LayoutTestController::staticFunctions):

* DumpRenderTree/LayoutTestController.h:
(LayoutTestController::newWindowsCopyBackForwardList):
(LayoutTestController::setNewWindowsCopyBackForwardList):

* DumpRenderTree/mac/UIDelegate.mm:
(-[UIDelegate webView:createWebViewWithRequest:]):

LayoutTests: 

* fast/loader/crash-copying-backforwardlist-expected.txt: Added.
* fast/loader/crash-copying-backforwardlist.html: Added.
* platform/gtk/Skipped:
* platform/qt/Skipped:
* platform/win/Skipped:



git-svn-id: svn://svn.chromium.org/blink/trunk@54145 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent d0a7a7bf
Hide whitespace changes
Inline Side-by-side
Showing with 115 additions and 6 deletions
third_party/WebKit/LayoutTests/ChangeLog
View file @ 4e060c0d
2010-02-01 Brady Eidson <beidson@apple.com>
Reviewed by Adele Peterson.
Crash in Safari opening new tabs to "same page"
<rdar://problem/7593857> and https://bugs.webkit.org/show_bug.cgi?id=34444
* fast/loader/crash-copying-backforwardlist-expected.txt: Added.
* fast/loader/crash-copying-backforwardlist.html: Added.
* platform/gtk/Skipped:
* platform/qt/Skipped:
* platform/win/Skipped:
2010-02-01 Eric Carlson <eric.carlson@apple.com> 2010-02-01 Eric Carlson <eric.carlson@apple.com>
Reviewed by Adele Peterson. Reviewed by Adele Peterson.
......
third_party/WebKit/LayoutTests/fast/loader/crash-copying-backforwardlist-expected.txt 0 → 100644
View file @ 4e060c0d
This test only works in DRT by tickling the [WebView _loadBackForwardListFromOtherView:] method.
If it doesn't crash, then the test passes.
third_party/WebKit/LayoutTests/fast/loader/crash-copying-backforwardlist.html 0 → 100644
View file @ 4e060c0d
<html>
<head>
<script>
if (window.layoutTestController) {
layoutTestController.dumpAsText();
layoutTestController.waitUntilDone();
layoutTestController.setCanOpenWindows(true);
layoutTestController.setNewWindowsCopyBackForwardList(true);
}
</script>
</head>
<body onload="window.open('data:text/html,<script>if (window.layoutTestController) layoutTestController.notifyDone();</script>');">
<pre>
This test only works in DRT by tickling the [WebView _loadBackForwardListFromOtherView:] method.
If it doesn't crash, then the test passes.
</pre>
</body>
</html>
third_party/WebKit/LayoutTests/platform/gtk/Skipped
View file @ 4e060c0d
...@@ -5785,3 +5785,7 @@ scrollbars/scrollbar-middleclick-nopaste.html ...@@ -5785,3 +5785,7 @@ scrollbars/scrollbar-middleclick-nopaste.html
# https://bugs.webkit.org/show_bug.cgi?id=34246 # https://bugs.webkit.org/show_bug.cgi?id=34246
fast/dom/Window/window-postmessage-clone-frames.html fast/dom/Window/window-postmessage-clone-frames.html
# Relies on WebKit API [WebView _loadBackForwardListFromOtherView:]
fast/loader/crash-copying-backforwardlist.html
third_party/WebKit/LayoutTests/platform/qt/Skipped
View file @ 4e060c0d
...@@ -5109,3 +5109,6 @@ http/tests/history/redirect-307.pl ...@@ -5109,3 +5109,6 @@ http/tests/history/redirect-307.pl
# small caps vs. normal text # small caps vs. normal text
# https://bugs.webkit.org/show_bug.cgi?id=34286 # https://bugs.webkit.org/show_bug.cgi?id=34286
css2.1/t1505-c524-font-var-00-b.html css2.1/t1505-c524-font-var-00-b.html
# Relies on WebKit API [WebView _loadBackForwardListFromOtherView:]
fast/loader/crash-copying-backforwardlist.html
third_party/WebKit/LayoutTests/platform/win/Skipped
View file @ 4e060c0d
...@@ -739,3 +739,7 @@ fast/dom/Window/window-properties-geolocation.html ...@@ -739,3 +739,7 @@ fast/dom/Window/window-properties-geolocation.html
# Needs to pass cookies to the media player # Needs to pass cookies to the media player
# See http://bugs.webkit.org/show_bug.cgi?id=33954 # See http://bugs.webkit.org/show_bug.cgi?id=33954
http/tests/media/video-cookie.html http/tests/media/video-cookie.html
# Relies on WebKit API [WebView _loadBackForwardListFromOtherView:]
fast/loader/crash-copying-backforwardlist.html
third_party/WebKit/WebCore/ChangeLog
View file @ 4e060c0d
2010-02-01 Brady Eidson <beidson@apple.com>
Reviewed by Adele Peterson.
Crash in Safari opening new tabs to "same page"
<rdar://problem/7593857> and https://bugs.webkit.org/show_bug.cgi?id=34444
Test: fast/loader/crash-copying-backforwardlist.html
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::loadItem): Null check currentItem().
* page/Page.cpp:
(WebCore::Page::goToItem): Ditto.
2010-02-01 Kevin Watters <kevinwatters@gmail.com> 2010-02-01 Kevin Watters <kevinwatters@gmail.com>
Reviewed by Kevin Ollivier. Reviewed by Kevin Ollivier.
......
third_party/WebKit/WebCore/loader/FrameLoader.cpp
View file @ 4e060c0d
...@@ -3818,7 +3818,9 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType) ...@@ -3818,7 +3818,9 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
// - The HistoryItem has a history state object // - The HistoryItem has a history state object
// - Navigating to an anchor within the page, with no form data stored on the target item or the current history entry, // - Navigating to an anchor within the page, with no form data stored on the target item or the current history entry,
// and the URLs in the frame tree match the history item for fragment scrolling. // and the URLs in the frame tree match the history item for fragment scrolling.
bool sameDocumentNavigation = (!item->formData() && !(history()->currentItem() && history()->currentItem()->formData()) && history()->urlsMatchItem(item)) || item->documentSequenceNumber() == history()->currentItem()->documentSequenceNumber(); HistoryItem* currentItem = history()->currentItem();
bool sameDocumentNavigation = (!item->formData() && !(currentItem && currentItem->formData()) && history()->urlsMatchItem(item))
|| (currentItem && item->documentSequenceNumber() == currentItem->documentSequenceNumber());
#if ENABLE(WML) #if ENABLE(WML)
// All WML decks should go through the real load mechanism, not the scroll-to-anchor code // All WML decks should go through the real load mechanism, not the scroll-to-anchor code
......
third_party/WebKit/WebCore/page/Page.cpp
View file @ 4e060c0d
...@@ -290,7 +290,8 @@ void Page::goBackOrForward(int distance) ...@@ -290,7 +290,8 @@ void Page::goBackOrForward(int distance)
void Page::goToItem(HistoryItem* item, FrameLoadType type) void Page::goToItem(HistoryItem* item, FrameLoadType type)
{ {
// Abort any current load unless we're navigating the current document to a new state object // Abort any current load unless we're navigating the current document to a new state object
if (!item->stateObject() || item->documentSequenceNumber() != m_mainFrame->loader()->history()->currentItem()->documentSequenceNumber()) { HistoryItem* currentItem = m_mainFrame->loader()->history()->currentItem();
if (!item->stateObject() || !currentItem || item->documentSequenceNumber() != currentItem->documentSequenceNumber()) {
// Define what to do with any open database connections. By default we stop them and terminate the database thread. // Define what to do with any open database connections. By default we stop them and terminate the database thread.
DatabasePolicy databasePolicy = DatabasePolicyStop; DatabasePolicy databasePolicy = DatabasePolicyStop;
......
third_party/WebKit/WebKitTools/ChangeLog
View file @ 4e060c0d
2010-02-01 Brady Eidson <beidson@apple.com>
Reviewed by Adele Peterson.
Crash in Safari opening new tabs to "same page"
<rdar://problem/7593857> and https://bugs.webkit.org/show_bug.cgi?id=34444
Add a mode (Mac-only for now) that exercises the WebView SPI _loadBackForwardListFromOtherView:
* DumpRenderTree/LayoutTestController.cpp:
(LayoutTestController::LayoutTestController):
(setNewWindowsCopyBackForwardListCallback):
(LayoutTestController::staticFunctions):
* DumpRenderTree/LayoutTestController.h:
(LayoutTestController::newWindowsCopyBackForwardList):
(LayoutTestController::setNewWindowsCopyBackForwardList):
* DumpRenderTree/mac/UIDelegate.mm:
(-[UIDelegate webView:createWebViewWithRequest:]):
2010-02-01 Carol Szabo <carol.szabo@nokia.com> 2010-02-01 Carol Szabo <carol.szabo@nokia.com>
Unreviewed. Unreviewed.
......
third_party/WebKit/WebKitTools/DumpRenderTree/LayoutTestController.cpp
View file @ 4e060c0d
...@@ -61,6 +61,7 @@ LayoutTestController::LayoutTestController(const std::string& testPathOrURL, con ...@@ -61,6 +61,7 @@ LayoutTestController::LayoutTestController(const std::string& testPathOrURL, con
, m_callCloseOnWebViews(true) , m_callCloseOnWebViews(true)
, m_canOpenWindows(false) , m_canOpenWindows(false)
, m_closeRemainingWindowsWhenComplete(true) , m_closeRemainingWindowsWhenComplete(true)
, m_newWindowsCopyBackForwardList(false)
, m_stopProvisionalFrameLoads(false) , m_stopProvisionalFrameLoads(false)
, m_testOnscreen(false) , m_testOnscreen(false)
, m_testRepaint(false) , m_testRepaint(false)
...@@ -743,6 +744,18 @@ static JSValueRef setMockGeolocationErrorCallback(JSContextRef context, JSObject ...@@ -743,6 +744,18 @@ static JSValueRef setMockGeolocationErrorCallback(JSContextRef context, JSObject
return JSValueMakeUndefined(context); return JSValueMakeUndefined(context);
} }
static JSValueRef setNewWindowsCopyBackForwardListCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
{
// Has mac implementation
if (argumentCount < 1)
return JSValueMakeUndefined(context);
LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
controller->setNewWindowsCopyBackForwardList(JSValueToBoolean(context, arguments[0]));
return JSValueMakeUndefined(context);
}
static JSValueRef setGeolocationPermissionCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) static JSValueRef setGeolocationPermissionCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
{ {
// Has mac implementation // Has mac implementation
...@@ -1324,6 +1337,7 @@ JSStaticFunction* LayoutTestController::staticFunctions() ...@@ -1324,6 +1337,7 @@ JSStaticFunction* LayoutTestController::staticFunctions()
{ "setMainFrameIsFirstResponder", setMainFrameIsFirstResponderCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete }, { "setMainFrameIsFirstResponder", setMainFrameIsFirstResponderCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
{ "setMockGeolocationPosition", setMockGeolocationPositionCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete }, { "setMockGeolocationPosition", setMockGeolocationPositionCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
{ "setMockGeolocationError", setMockGeolocationErrorCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete }, { "setMockGeolocationError", setMockGeolocationErrorCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
{ "setNewWindowsCopyBackForwardList", setNewWindowsCopyBackForwardListCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
{ "setPersistentUserStyleSheetLocation", setPersistentUserStyleSheetLocationCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete }, { "setPersistentUserStyleSheetLocation", setPersistentUserStyleSheetLocationCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
{ "setPopupBlockingEnabled", setPopupBlockingEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete }, { "setPopupBlockingEnabled", setPopupBlockingEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
{ "setPrivateBrowsingEnabled", setPrivateBrowsingEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete }, { "setPrivateBrowsingEnabled", setPrivateBrowsingEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
......
third_party/WebKit/WebKitTools/DumpRenderTree/LayoutTestController.h
View file @ 4e060c0d
...@@ -66,28 +66,29 @@ public: ...@@ -66,28 +66,29 @@ public:
void queueReload(); void queueReload();
void removeAllVisitedLinks(); void removeAllVisitedLinks();
void setAcceptsEditing(bool acceptsEditing); void setAcceptsEditing(bool acceptsEditing);
void setAppCacheMaximumSize(unsigned long long quota);
void setAllowUniversalAccessFromFileURLs(bool); void setAllowUniversalAccessFromFileURLs(bool);
void setAppCacheMaximumSize(unsigned long long quota);
void setAuthorAndUserStylesEnabled(bool); void setAuthorAndUserStylesEnabled(bool);
void setCacheModel(int); void setCacheModel(int);
void setCustomPolicyDelegate(bool setDelegate, bool permissive); void setCustomPolicyDelegate(bool setDelegate, bool permissive);
void setDatabaseQuota(unsigned long long quota); void setDatabaseQuota(unsigned long long quota);
void setDomainRelaxationForbiddenForURLScheme(bool forbidden, JSStringRef scheme); void setDomainRelaxationForbiddenForURLScheme(bool forbidden, JSStringRef scheme);
void setMockGeolocationPosition(double latitude, double longitude, double accuracy);
void setMockGeolocationError(int code, JSStringRef message);
void setIconDatabaseEnabled(bool iconDatabaseEnabled); void setIconDatabaseEnabled(bool iconDatabaseEnabled);
void setJavaScriptProfilingEnabled(bool profilingEnabled); void setJavaScriptProfilingEnabled(bool profilingEnabled);
void setMainFrameIsFirstResponder(bool flag); void setMainFrameIsFirstResponder(bool flag);
void setMockGeolocationError(int code, JSStringRef message);
void setMockGeolocationPosition(double latitude, double longitude, double accuracy);
void setPersistentUserStyleSheetLocation(JSStringRef path); void setPersistentUserStyleSheetLocation(JSStringRef path);
void setPopupBlockingEnabled(bool flag); void setPopupBlockingEnabled(bool flag);
void setPrivateBrowsingEnabled(bool flag); void setPrivateBrowsingEnabled(bool flag);
void setXSSAuditorEnabled(bool flag);
void setSelectTrailingWhitespaceEnabled(bool flag); void setSelectTrailingWhitespaceEnabled(bool flag);
void setSmartInsertDeleteEnabled(bool flag); void setSmartInsertDeleteEnabled(bool flag);
void setTabKeyCyclesThroughElements(bool cycles); void setTabKeyCyclesThroughElements(bool cycles);
void setUseDashboardCompatibilityMode(bool flag); void setUseDashboardCompatibilityMode(bool flag);
void setUserStyleSheetEnabled(bool flag); void setUserStyleSheetEnabled(bool flag);
void setUserStyleSheetLocation(JSStringRef path); void setUserStyleSheetLocation(JSStringRef path);
void setXSSAuditorEnabled(bool flag);
void waitForPolicyDelegate(); void waitForPolicyDelegate();
size_t webHistoryItemCount(); size_t webHistoryItemCount();
unsigned workerThreadCount() const; unsigned workerThreadCount() const;
...@@ -161,6 +162,9 @@ public: ...@@ -161,6 +162,9 @@ public:
bool closeRemainingWindowsWhenComplete() const { return m_closeRemainingWindowsWhenComplete; } bool closeRemainingWindowsWhenComplete() const { return m_closeRemainingWindowsWhenComplete; }
void setCloseRemainingWindowsWhenComplete(bool closeRemainingWindowsWhenComplete) { m_closeRemainingWindowsWhenComplete = closeRemainingWindowsWhenComplete; } void setCloseRemainingWindowsWhenComplete(bool closeRemainingWindowsWhenComplete) { m_closeRemainingWindowsWhenComplete = closeRemainingWindowsWhenComplete; }
bool newWindowsCopyBackForwardList() const { return m_newWindowsCopyBackForwardList; }
void setNewWindowsCopyBackForwardList(bool newWindowsCopyBackForwardList) { m_newWindowsCopyBackForwardList = newWindowsCopyBackForwardList; }
bool stopProvisionalFrameLoads() const { return m_stopProvisionalFrameLoads; } bool stopProvisionalFrameLoads() const { return m_stopProvisionalFrameLoads; }
void setStopProvisionalFrameLoads(bool stopProvisionalFrameLoads) { m_stopProvisionalFrameLoads = stopProvisionalFrameLoads; } void setStopProvisionalFrameLoads(bool stopProvisionalFrameLoads) { m_stopProvisionalFrameLoads = stopProvisionalFrameLoads; }
...@@ -248,6 +252,7 @@ private: ...@@ -248,6 +252,7 @@ private:
bool m_callCloseOnWebViews; bool m_callCloseOnWebViews;
bool m_canOpenWindows; bool m_canOpenWindows;
bool m_closeRemainingWindowsWhenComplete; bool m_closeRemainingWindowsWhenComplete;
bool m_newWindowsCopyBackForwardList;
bool m_stopProvisionalFrameLoads; bool m_stopProvisionalFrameLoads;
bool m_testOnscreen; bool m_testOnscreen;
bool m_testRepaint; bool m_testRepaint;
......
third_party/WebKit/WebKitTools/DumpRenderTree/mac/UIDelegate.mm
View file @ 4e060c0d
...@@ -38,6 +38,7 @@ ...@@ -38,6 +38,7 @@
#import <WebKit/WebSecurityOriginPrivate.h> #import <WebKit/WebSecurityOriginPrivate.h>
#import <WebKit/WebUIDelegatePrivate.h> #import <WebKit/WebUIDelegatePrivate.h>
#import <WebKit/WebView.h> #import <WebKit/WebView.h>
#import <WebKit/WebViewPrivate.h>
#import <wtf/Assertions.h> #import <wtf/Assertions.h>
DumpRenderTreeDraggingInfo *draggingInfo = nil; DumpRenderTreeDraggingInfo *draggingInfo = nil;
...@@ -122,6 +123,9 @@ DumpRenderTreeDraggingInfo *draggingInfo = nil; ...@@ -122,6 +123,9 @@ DumpRenderTreeDraggingInfo *draggingInfo = nil;
WebView *webView = createWebViewAndOffscreenWindow(); WebView *webView = createWebViewAndOffscreenWindow();
if (gLayoutTestController->newWindowsCopyBackForwardList())
[webView _loadBackForwardListFromOtherView:sender];
return [webView autorelease]; return [webView autorelease];
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment