[SCM] WebKit Debian packaging branch, debian/unstable, updated. debian/1.2.3-2-60-g76add97

Sun Oct 17 22:27:32 UTC 2010

The following commit has been merged in the debian/unstable branch:
commit b2bea2e25a0080f85288e09db94cc958525e23b9
Author: jschuh at chromium.org <jschuh at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Thu Jul 29 18:11:09 2010 +0000

    2010-07-28  Justin Schuh  <jschuh at chromium.org>
    
            Reviewed by Nate Chapin.
    
            Clear PluginData's page pointer on Page destruction
            https://bugs.webkit.org/show_bug.cgi?id=43147
    
            Test: plugins/access-after-page-destroyed.html
    
            * page/Page.cpp:
            (WebCore::Page::~Page):
    2010-07-28  Justin Schuh  <jschuh at chromium.org>
    
            Reviewed by Nate Chapin.
    
            Clear PluginData's page pointer on Page destruction
            https://bugs.webkit.org/show_bug.cgi?id=43147
    
            * plugins/access-after-page-destroyed-expected.txt: Added.
            * plugins/access-after-page-destroyed.html: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@64293 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 2efb1ba..e510824 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-07-28  Justin Schuh  <jschuh at chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        Clear PluginData's page pointer on Page destruction
+        https://bugs.webkit.org/show_bug.cgi?id=43147
+
+        * plugins/access-after-page-destroyed-expected.txt: Added.
+        * plugins/access-after-page-destroyed.html: Added.
+
 2010-08-17  Steve Block  <steveblock at google.com>
 
         Reviewed by Jeremy Orlow.
diff --git a/LayoutTests/plugins/access-after-page-destroyed-expected.txt b/LayoutTests/plugins/access-after-page-destroyed-expected.txt
new file mode 100644
index 0000000..735404e
--- /dev/null
+++ b/LayoutTests/plugins/access-after-page-destroyed-expected.txt
@@ -0,0 +1 @@
+If the page does not trigger a crash the test passed.
diff --git a/LayoutTests/plugins/access-after-page-destroyed.html b/LayoutTests/plugins/access-after-page-destroyed.html
new file mode 100644
index 0000000..447461d
--- /dev/null
+++ b/LayoutTests/plugins/access-after-page-destroyed.html
@@ -0,0 +1,26 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.setCanOpenWindows();
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+var w = open();
+var p = w.navigator.mimeTypes.item(0);
+w.close();
+w = null;
+
+setTimeout(function(){
+    p.enabledPlugin;
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}, 50); // Pause is necessary for the page to get freed
+
+</script>
+</head>
+<body>
+If the page does not trigger a crash the test passed.
+</body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 39a1922..07996bd 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2010-07-28  Justin Schuh  <jschuh at chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        Clear PluginData's page pointer on Page destruction
+        https://bugs.webkit.org/show_bug.cgi?id=43147
+
+        Test: plugins/access-after-page-destroyed.html
+
+        * page/Page.cpp:
+        (WebCore::Page::~Page):
+
 2010-08-17  Steve Block  <steveblock at google.com>
 
         Reviewed by Jeremy Orlow.
diff --git a/WebCore/page/Page.cpp b/WebCore/page/Page.cpp
index d66e497..228e1de 100644
--- a/WebCore/page/Page.cpp
+++ b/WebCore/page/Page.cpp
@@ -192,6 +192,9 @@ Page::~Page()
         frame->pageDestroyed();
 
     m_editorClient->pageDestroyed();
+    if (m_pluginData)
+        m_pluginData->disconnectPage();
+    
 #if ENABLE(INSPECTOR)
     m_inspectorController->inspectedPageDestroyed();
 #endif

-- 
WebKit Debian packaging

