Implement StringImpl sharing for StringView::toString().

third_party/WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  * Copyright (C) 2009 Torch Mobile, Inc. http://www.torchmobile.com/
  * Copyright (C) 2010 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 175 matching lines @@
     {
         if (!m_tagImpl)
             return;
         for (const CompactHTMLToken::Attribute& htmlTokenAttribute : attributes)
             processAttribute(htmlTokenAttribute.name(), htmlTokenAttribute.value());
     }
 
     void handlePictureSourceURL(PictureData& pictureData)
     {
         if (match(m_tagImpl, sourceTag) && m_matched && pictureData.sourceURL.isEmpty()) {
-            pictureData.sourceURL = m_srcsetImageCandidate.toString();
+            // Must create an isolatedCopy() since the srcset attribute value will
+            // get sent back to the main thread between when we set this, and when we
+            // process the closing tag which would clear m_pictureData. Having any
+            // ref to a string we're going to send will fail isSafeToSendToAnotherThread().

[esprehn, 2016/06/03 20:28:29]

This was a bug that already existed, but StringView::toString() used to always
vend a new string, even when the m_length was the same as the full string which
was hiding this bug by creating a new string inside toString(). All the other
stuff that the preload scanner stores already do this, ex. PreloadRequest makes
an isolatedCopy() of any String it might send.

+            pictureData.sourceURL = m_srcsetImageCandidate.toString().isolatedCopy();
             pictureData.sourceSizeSet = m_sourceSizeSet;
             pictureData.sourceSize = m_sourceSize;
             pictureData.picked = true;
         } else if (match(m_tagImpl, imgTag) && !pictureData.sourceURL.isEmpty()) {
             setUrlToLoad(pictureData.sourceURL, AllowURLReplacement);
         }
     }
 
     PassOwnPtr<PreloadRequest> createPreloadRequest(const KURL& predictedBaseURL, const SegmentedString& source, const ClientHintsPreferences& clientHintsPreferences, const PictureData& pictureData, const ReferrerPolicy documentReferrerPolicy)
     {
@@ skipping 597 matching lines @@
     ASSERT(document);
     doHtmlPreloadScanning = !document->settings() || document->settings()->doHtmlPreloadScanning();
     doDocumentWritePreloadScanning = doHtmlPreloadScanning && document->frame() && document->frame()->isMainFrame();
     defaultViewportMinWidth = document->viewportDefaultMinWidth();
     viewportMetaZeroValuesQuirk = document->settings() && document->settings()->viewportMetaZeroValuesQuirk();
     viewportMetaEnabled = document->settings() && document->settings()->viewportMetaEnabled();
     referrerPolicy = document->getReferrerPolicy();
 }
 
 } // namespace blink