Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1316)

Unified Diff: Source/core/loader/FrameLoader.cpp

Issue 517043003: Move Frame to the Oilpan heap. (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master
Patch Set: Rebase past r181245 conflict Created 6 years, 3 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: Source/core/loader/FrameLoader.cpp
diff --git a/Source/core/loader/FrameLoader.cpp b/Source/core/loader/FrameLoader.cpp
index bf7bcdd39de5b2398d7cec175fec149a7d187f50..9fa07815dbbe6d8895033221a5334e44cebcbc42 100644
--- a/Source/core/loader/FrameLoader.cpp
+++ b/Source/core/loader/FrameLoader.cpp
@@ -50,6 +50,7 @@
#include "core/fetch/ResourceLoader.h"
#include "core/frame/LocalDOMWindow.h"
#include "core/frame/FrameHost.h"
+#include "core/frame/FrameProtector.h"
#include "core/frame/FrameView.h"
#include "core/frame/LocalFrame.h"
#include "core/frame/PinchViewport.h"
@@ -130,6 +131,12 @@ FrameLoader::~FrameLoader()
{
}
+void FrameLoader::trace(Visitor* visitor)
+{
+ visitor->trace(m_frame);
+ visitor->trace(m_fetchContext);
+}
+
void FrameLoader::init()
{
ResourceRequest initialRequest(KURL(ParsedURLString, emptyString()));
@@ -242,6 +249,9 @@ void FrameLoader::didExplicitOpen()
void FrameLoader::clear()
{
+ // clear() is called during (Local)Frame finalization and when creating
+ // a new Document within it (DocumentLoader::createWriterFor().)
+
if (m_stateMachine.creatingInitialEmptyDocument())
return;
@@ -357,7 +367,8 @@ void FrameLoader::receivedFirstData()
static void didFailContentSecurityPolicyCheck(FrameLoader* loader)
{
// load event and stopAllLoaders can detach the LocalFrame, so protect it.
- RefPtr<LocalFrame> frame(loader->frame());
+ LocalFrame* frame = loader->frame();
+ FrameProtector protect(frame);
// Move the page to a unique origin, and cancel the load.
frame->document()->enforceSandboxFlags(SandboxOrigin);
@@ -420,7 +431,7 @@ void FrameLoader::finishedParsing()
// This can be called from the LocalFrame's destructor, in which case we shouldn't protect ourselves
// because doing so will cause us to re-enter the destructor when protector goes out of scope.
// Null-checking the FrameView indicates whether or not we're in the destructor.
- RefPtr<LocalFrame> protector = m_frame->view() ? m_frame : 0;
+ FrameProtector protect(m_frame->view() ? m_frame : nullptr);
if (client())
client()->dispatchDidFinishDocumentLoad();
@@ -464,7 +475,7 @@ bool FrameLoader::allAncestorsAreComplete() const
void FrameLoader::checkCompleted()
{
- RefPtr<LocalFrame> protect(m_frame);
+ FrameProtector protect(m_frame);
if (m_frame->view())
m_frame->view()->handleLoadCompleted();
@@ -606,7 +617,7 @@ void FrameLoader::loadInSameDocument(const KURL& url, PassRefPtr<SerializedScrip
void FrameLoader::completed()
{
- RefPtr<LocalFrame> protect(m_frame);
+ FrameProtector protect(m_frame);
for (Frame* descendant = m_frame->tree().traverseNext(m_frame); descendant; descendant = descendant->tree().traverseNext(m_frame)) {
if (descendant->isLocalFrame())
@@ -730,7 +741,7 @@ void FrameLoader::load(const FrameLoadRequest& passedRequest)
{
ASSERT(m_frame->document());
- RefPtr<LocalFrame> protect(m_frame);
+ FrameProtector protect(m_frame);
if (m_inStopAllLoaders)
return;
@@ -739,7 +750,8 @@ void FrameLoader::load(const FrameLoadRequest& passedRequest)
if (!prepareRequestForThisFrame(request))
return;
- RefPtr<LocalFrame> targetFrame = request.formState() ? 0 : findFrameForNavigation(AtomicString(request.frameName()), request.formState() ? request.formState()->sourceDocument() : m_frame->document());
+ LocalFrame* targetFrame = request.formState() ? 0 : findFrameForNavigation(AtomicString(request.frameName()), request.formState() ? request.formState()->sourceDocument() : m_frame->document());
+ FrameProtector protectTarget(targetFrame);
if (targetFrame && targetFrame != m_frame) {
request.setFrameName("_self");
targetFrame->loader().load(request);
@@ -752,7 +764,7 @@ void FrameLoader::load(const FrameLoadRequest& passedRequest)
NavigationAction action(request.resourceRequest(), newLoadType, request.formState(), request.triggeringEvent());
if (action.resourceRequest().requestContext() == WebURLRequest::RequestContextUnspecified)
action.mutableResourceRequest().setRequestContext(determineRequestContextFromNavigationType(action.type()));
- if (shouldOpenInNewWindow(targetFrame.get(), request, action)) {
+ if (shouldOpenInNewWindow(targetFrame, request, action)) {
if (action.policy() == NavigationPolicyDownload)
client()->loadURLExternally(action.resourceRequest(), NavigationPolicyDownload);
else
@@ -852,11 +864,11 @@ void FrameLoader::stopAllLoaders()
// Calling stopLoading() on the provisional document loader can blow away
// the frame from underneath.
- RefPtr<LocalFrame> protect(m_frame);
+ FrameProtector protect(m_frame);
m_inStopAllLoaders = true;
- for (RefPtr<Frame> child = m_frame->tree().firstChild(); child; child = child->tree().nextSibling()) {
+ for (RefPtrWillBeRawPtr<Frame> child = m_frame->tree().firstChild(); child; child = child->tree().nextSibling()) {
if (child->isLocalFrame())
toLocalFrame(child.get())->loader().stopAllLoaders();
}
@@ -914,7 +926,7 @@ void FrameLoader::commitProvisionalLoad()
ASSERT(client()->hasWebView());
ASSERT(m_state == FrameStateProvisional);
RefPtr<DocumentLoader> pdl = m_provisionalDocumentLoader;
- RefPtr<LocalFrame> protect(m_frame);
+ FrameProtector protect(m_frame);
// Check if the destination page is allowed to access the previous page's timing information.
if (m_frame->document()) {
@@ -989,10 +1001,10 @@ static bool isDocumentDoneLoading(Document* document)
bool FrameLoader::checkLoadCompleteForThisFrame()
{
ASSERT(client()->hasWebView());
- RefPtr<LocalFrame> protect(m_frame);
+ FrameProtector protect(m_frame);
bool allChildrenAreDoneLoading = true;
- for (RefPtr<Frame> child = m_frame->tree().firstChild(); child; child = child->tree().nextSibling()) {
+ for (RefPtrWillBeRawPtr<Frame> child = m_frame->tree().firstChild(); child; child = child->tree().nextSibling()) {
if (child->isLocalFrame())
allChildrenAreDoneLoading &= toLocalFrame(child.get())->loader().checkLoadCompleteForThisFrame();
}
@@ -1120,7 +1132,9 @@ String FrameLoader::userAgent(const KURL& url) const
void FrameLoader::detachFromParent()
{
// The caller must protect a reference to m_frame.
+#if !ENABLE(OILPAN)
ASSERT(m_frame->refCount() > 1);
+#endif
InspectorInstrumentation::frameDetachedFromParent(m_frame);
@@ -1174,7 +1188,7 @@ void FrameLoader::detachClient()
void FrameLoader::receivedMainResourceError(const ResourceError& error)
{
// Retain because the stop may release the last reference to it.
- RefPtr<LocalFrame> protect(m_frame);
+ FrameProtector protect(m_frame);
if (m_frame->document()->parser())
m_frame->document()->parser()->stopParsing();
@@ -1216,7 +1230,8 @@ void FrameLoader::scrollToFragmentWithParentBoundary(const KURL& url)
return;
// Leaking scroll position to a cross-origin ancestor would permit the so-called "framesniffing" attack.
- RefPtr<LocalFrame> boundaryFrame(url.hasFragmentIdentifier() ? m_frame->document()->findUnsafeParentScrollPropagationBoundary() : 0);
+ LocalFrame* boundaryFrame = url.hasFragmentIdentifier() ? m_frame->document()->findUnsafeParentScrollPropagationBoundary() : 0;
+ FrameProtector protect(boundaryFrame);
if (boundaryFrame)
boundaryFrame->view()->setSafeToPropagateScrollToParent(false);
@@ -1234,7 +1249,7 @@ bool FrameLoader::shouldClose()
return true;
// Store all references to each subframe in advance since beforeunload's event handler may modify frame
- Vector<RefPtr<LocalFrame> > targetFrames;
+ WillBeHeapVector<RefPtrWillBeMember<LocalFrame> > targetFrames;
targetFrames.append(m_frame);
for (Frame* child = m_frame->tree().firstChild(); child; child = child->tree().traverseNext(m_frame)) {
// FIXME: There is not yet any way to dispatch events to out-of-process frames.
@@ -1321,7 +1336,7 @@ void FrameLoader::loadWithNavigationAction(const NavigationAction& action, Frame
isTransitionNavigation = dispatchNavigationTransitionData();
// stopAllLoaders can detach the LocalFrame, so protect it.
- RefPtr<LocalFrame> protect(m_frame);
+ FrameProtector protect(m_frame);
if ((!m_policyDocumentLoader->shouldContinueForNavigationPolicy(request, shouldCheckMainWorldContentSecurityPolicy, isTransitionNavigation) || !shouldClose()) && m_policyDocumentLoader) {
m_policyDocumentLoader->detachFromFrame();
m_policyDocumentLoader = nullptr;
@@ -1442,7 +1457,7 @@ LocalFrame* FrameLoader::findFrameForNavigation(const AtomicString& name, Docume
void FrameLoader::loadHistoryItem(HistoryItem* item, HistoryLoadType historyLoadType, ResourceRequestCachePolicy cachePolicy)
{
- RefPtr<LocalFrame> protect(m_frame);
+ FrameProtector protect(m_frame);
if (m_frame->page()->defersLoading()) {
m_deferredHistoryLoad = DeferredHistoryLoad(item, historyLoadType, cachePolicy);
return;

Powered by Google App Engine
This is Rietveld 408576698