Better handle reentrancy into DocumentLoader::dataReceived().

Source/core/loader/DocumentLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 54 matching lines @@
 #include "platform/mhtml/ArchiveResource.h"
 #include "platform/mhtml/ArchiveResourceCollection.h"
 #include "platform/mhtml/MHTMLArchive.h"
 #include "platform/network/ContentSecurityPolicyResponseHeaders.h"
 #include "platform/plugins/PluginData.h"
 #include "platform/weborigin/SchemeRegistry.h"
 #include "platform/weborigin/SecurityPolicy.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebMimeRegistry.h"
 #include "wtf/Assertions.h"
+#include "wtf/TemporaryChange.h"
 #include "wtf/text/WTFString.h"
 
 namespace blink {
 
 static bool isArchiveMIMEType(const String& mimeType)
 {
     return equalIgnoringCase("multipart/related", mimeType);
 }
 
 DocumentLoader::DocumentLoader(LocalFrame* frame, const ResourceRequest& req, const SubstituteData& substituteData)
     : m_frame(frame)
     , m_fetcher(FrameFetchContext::createContextAndFetcher(this))
     , m_originalRequest(req)
     , m_substituteData(substituteData)
     , m_request(req)
     , m_isClientRedirect(false)
     , m_replacesCurrentHistoryItem(false)
     , m_navigationType(NavigationTypeOther)
     , m_timeOfLastDataReceived(0.0)
     , m_applicationCacheHost(ApplicationCacheHost::create(this))
     , m_state(NotStarted)
+    , m_inDataReceived(false)
+    , m_dataBuffer(SharedBuffer::create())
 {
 }
 
 FrameLoader* DocumentLoader::frameLoader() const
 {
     if (!m_frame)
         return nullptr;
     return &m_frame->loader();
 }
 
@@ skipping 441 matching lines @@
 }
 
 void DocumentLoader::dataReceived(Resource* resource, const char* data, unsigned length)
 {
     ASSERT(data);
     ASSERT(length);
     ASSERT_UNUSED(resource, resource == m_mainResource);
     ASSERT(!m_response.isNull());
     ASSERT(!mainResourceLoader() || !mainResourceLoader()->defersLoading());
 
+    if (m_inDataReceived) {
+        // If this function is reentered, defer processing of the additional
+        // data to the top-level invocation. Reentrant calls can occur because
+        // of web platform (mis-)features that require running a nested message
+        // loop:
+        // - alert(), confirm(), prompt()
+        // - Detach of plugin elements.
+        // - Synchronous XMLHTTPRequest
+        m_dataBuffer->append(data, length);
+        return;
+    }
+
     // Both unloading the old page and parsing the new page may execute JavaScript which destroys the datasource
     // by starting a new load, so retain temporarily.
     RefPtrWillBeRawPtr<LocalFrame> protectFrame(m_frame.get());
     RefPtrWillBeRawPtr<DocumentLoader> protectLoader(this);
 
+    TemporaryChange<bool> reentrancyProtector(m_inDataReceived, true);
+    processData(data, length);
+
+    // Process data received in reentrant invocations. Note that the
+    // invocations of processData() may queue more data in reentrant
+    // invocations, so iterate until it's empty.
+    const char* segment;
+    unsigned pos = 0;
+    while (unsigned length = m_dataBuffer->getSomeData(segment, pos)) {
+        processData(segment, length);
+        pos += length;
+    }
+    // All data has been consumed, so flush the buffer.
+    m_dataBuffer->clear();
+}
+
+void DocumentLoader::processData(const char* data, unsigned length)
+{
     m_applicationCacheHost->mainResourceDataReceived(data, length);
     m_timeOfLastDataReceived = monotonicallyIncreasingTime();
 
     if (isArchiveMIMEType(response().mimeType()))
         return;
     commitIfReady();
     if (!frameLoader())
         return;
     commitData(data, length);
 
@@ skipping 249 matching lines @@
 {
     m_writer = createWriterFor(ownerDocument, init, mimeType(), m_writer ? m_writer->encoding() : emptyAtom, true, ForceSynchronousParsing);
     if (!source.isNull())
         m_writer->appendReplacingData(source);
     endWriting(m_writer.get());
 }
 
 DEFINE_WEAK_IDENTIFIER_MAP(DocumentLoader);
 
 } // namespace blink