Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(58)

Issue 333823006: Revert "Allow XHR timeout attribute to be overridden after send(), per spec" (Closed)

Created:
6 years, 6 months ago by abarth-chromium
Modified:
6 years, 6 months ago
Reviewers:
CC:
blink-reviews, Nate Chapin, gavinp+loader_chromium.org
Project:
blink
Visibility:
Public.

Description

Revert "Allow XHR timeout attribute to be overridden after send(), per spec" This reverts https://codereview.chromium.org/273993002, which might have caused the following ASAN failures: http://build.chromium.org/p/chromium.memory/builders/Linux%20ASan%20LSan%20Tests%20%281%29/builds/3314/steps/browser_tests/logs/MimeHandler ==22764==ERROR: AddressSanitizer: heap-use-after-free on address 0x612000001c78 at pc 0x870ca08 bp 0x7fff7edd07f0 sp 0x7fff7edd07e8 WRITE of size 8 at 0x612000001c78 thread T0 (browser_tests) [22723:22723:0621/141550:INFO:nacl_browsertest_util.cc(132)] |||| [STARTUP] 0 0x870ca07 in handleSuccessfulFinish third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp:393 1 0x870ca07 in notifyFinished third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp:382 2 0x870ca07 in non-virtual thunk to WebCore::DocumentThreadableLoader::notifyFinished(WebCore::Resource*) third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp:383 3 0x84b1129 in WebCore::Resource::checkNotify() third_party/WebKit/Source/core/fetch/Resource.cpp:198 4 0x84b23cc in WebCore::Resource::finish(double) third_party/WebKit/Source/core/fetch/Resource.cpp:258 5 0x84e17b5 in WebCore::ResourceLoader::didFinishLoading(blink::WebURLLoader*, double, long) third_party/WebKit/Source/core/fetch/ResourceLoader.cpp:425 6 0xca68742 in content::WebURLLoaderImpl::Context::OnCompletedRequest(int, bool, bool, std::string const&, base::TimeTicks const&, long) content/child/web_url_loader_impl.cc:637 7 0xca3400a in content::ResourceDispatcher::OnRequestComplete(int, ResourceMsg_RequestCompleteData const&) content/child/resource_dispatcher.cc:561 8 0xca2fca3 in DispatchToMethod\u003Ccontent::ResourceDispatcher, void (content::ResourceDispatcher::*)(int, const ResourceMsg_RequestCompleteData &), int, ResourceMsg_RequestCompleteData> base/tuple.h:555 9 0xca2fca3 in Dispatch\u003Ccontent::ResourceDispatcher, content::ResourceDispatcher, void, void (content::ResourceDispatcher::*)(int, const ResourceMsg_RequestCompleteData &)> content/common/resource_messages.h:299 10 0xca2fca3 in content::ResourceDispatcher::DispatchMessage(IPC::Message const&) content/child/resource_dispatcher.cc:709 11 0xca2dc61 in content::ResourceDispatcher::OnMessageReceived(IPC::Message const&) content/child/resource_dispatcher.cc:319 12 0xc99d476 in content::ChildThread::OnMessageReceived(IPC::Message const&) content/child/child_thread.cc:441 <truncated, full output is in gzipped JSON output at end of step> 17 0x000002e280e7 ChromeBrowserMainParts::PreMainMessageLoopRun() 18 0x0000058a5538 content::BrowserMainLoop::PreMainMessageLoopRun() 19 0x000005bf69f8 content::StartupTaskRunner::RunAllTasksNow() 20 0x0000058a1c01 content::BrowserMainLoop::CreateStartupTasks() 21 0x000005d8c134 content::BrowserMainRunnerImpl::Initialize() 22 0x00000eee3cc1 content::BrowserMain() 23 0x00000ee1f601 content::ContentMainRunnerImpl::Run() 24 0x00000ee1c7b0 content::ContentMain() 25 0x00000cde7400 content::BrowserTestBase::SetUp() 26 0x000003402934 InProcessBrowserTest::SetUp() 27 0x000003e70a82 testing::Test::Run() 28 0x000003e72e1a testing::TestInfo::Run() 29 0x000003e73ba7 testing::TestCase::Run() 30 0x000003e86cbb testing::internal::UnitTestImpl::RunAllTests() 31 0x000003e862f1 testing::UnitTest::Run() 32 0x0000035a55dd base::TestSuite::Run() 33 0x000002116a75 ChromeBrowserTestSuiteRunner::RunTestSuite() 34 0x00000ce61a0a content::LaunchTests() 35 0x0000033ffc0c LaunchChromeTests() 36 0x000002116969 main BUG= Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=176702

Patch Set 1 #

Unified diffs Side-by-side diffs Delta from patch set Stats (+1 line, -210 lines) Patch
D LayoutTests/http/tests/xmlhttprequest/ontimeout-event-override.html View 1 chunk +0 lines, -42 lines 0 comments Download
D LayoutTests/http/tests/xmlhttprequest/ontimeout-event-override-expected.txt View 1 chunk +0 lines, -6 lines 0 comments Download
D LayoutTests/http/tests/xmlhttprequest/workers/resources/xmlhttprequest-timeout-override.js View 1 chunk +0 lines, -30 lines 0 comments Download
D LayoutTests/http/tests/xmlhttprequest/workers/resources/xmlhttprequest-timeout-override-worker.js View 1 chunk +0 lines, -41 lines 0 comments Download
D LayoutTests/http/tests/xmlhttprequest/workers/xmlhttprequest-timeout-override.html View 1 chunk +0 lines, -10 lines 0 comments Download
D LayoutTests/http/tests/xmlhttprequest/workers/xmlhttprequest-timeout-override-expected.txt View 1 chunk +0 lines, -4 lines 0 comments Download
M Source/core/loader/DocumentThreadableLoader.h View 2 chunks +0 lines, -3 lines 0 comments Download
M Source/core/loader/DocumentThreadableLoader.cpp View 9 chunks +1 line, -32 lines 0 comments Download
M Source/core/loader/ThreadableLoader.h View 1 chunk +0 lines, -7 lines 0 comments Download
M Source/core/loader/WorkerThreadableLoader.h View 3 chunks +0 lines, -4 lines 0 comments Download
M Source/core/loader/WorkerThreadableLoader.cpp View 2 chunks +0 lines, -22 lines 0 comments Download
M Source/core/xml/XMLHttpRequest.cpp View 1 chunk +0 lines, -9 lines 0 comments Download

Messages

Total messages: 2 (0 generated)
abarth-chromium
Committed patchset #1 manually as r176702 (tree was closed).
6 years, 6 months ago (2014-06-21 23:44:02 UTC) #1
zhaoqin
6 years, 6 months ago (2014-06-22 02:29:59 UTC) #2
Message was sent while issue was closed.
On 2014/06/21 23:44:02, abarth wrote:
> Committed patchset #1 manually as r176702 (tree was closed).

Thanks for the revert.
The original blink roll r278980 causes many similar use-after-free errors
reported by Dr.Memory from browser_tests and content_browsertests on Windows.
http://build.chromium.org/p/chromium.memory.fyi/builders/Windows%20Content%20...

Powered by Google App Engine
This is Rietveld 408576698