Should protect document in ProcessingInstruction::setXSLStyleSheet.

Should protect document in ProcessingInstruction::setXSLStyleSheet.

BUG=403276
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=182309

[tasak, 2014-09-18 08:24:44]

tasak@google.com changed reviewers:
+ dglazkov@chromium.org

[tasak, 2014-09-18 08:24:45]

Would you review this CL?

I manually tested, because it is difficult to create layout tests.

To see the following crash dump, I need to push reload button 10~20 times:

Received signal 11 <unknown> 000000000000
#0 0x000000892f9e base::debug::StackTrace::StackTrace()
#1 0x000000892ad3 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7fcebc93dcb0 <unknown>
#3 0x00000299209c WTF::Vector<>::size()
#4 0x000002991c9b blink::HTMLImportsController::loaderFor()
#5 0x00000254e94d blink::Document::importLoader()
#6 0x0000025599e8 blink::Document::didRemoveAllPendingStylesheet()
#7 0x00000264b515 blink::StyleEngine::removePendingSheet()
#8 0x000002620969 blink::ProcessingInstruction::sheetLoaded()
#9 0x000002f2c171 blink::XSLStyleSheet::checkLoaded()
#10 0x000002620dd6 blink::ProcessingInstruction::parseStyleSheet()
#11 0x000002620f7b blink::ProcessingInstruction::setXSLStyleSheet()
#12 0x000002620fcf blink::ProcessingInstruction::setXSLStyleSheet()
#13 0x000002d1a384 blink::XSLStyleSheetResource::didAddClient()
#14 0x000002cf33c3 blink::Resource::finishPendingClients()
#15 0x000002cf4aa7 blink::Resource::ResourceCallback::timerFired()
#16 0x000002cf8e6f blink::Timer<>::fired()

[sof, 2014-09-18 08:55:41]

sigbjornf@opera.com changed reviewers:
+ sigbjornf@opera.com

[sof, 2014-09-18 08:55:42]

https://codereview.chromium.org/579133004/diff/1/Source/core/dom/ProcessingIn...
File Source/core/dom/ProcessingInstruction.cpp (right):

https://codereview.chromium.org/579133004/diff/1/Source/core/dom/ProcessingIn...
Source/core/dom/ProcessingInstruction.cpp:221: RefPtr<Document>
protect(&document());
Please make it RefPtrWillBeRawPtr<Document> ? :)

[tasak, 2014-09-18 09:13:12]

Thank you.

https://codereview.chromium.org/579133004/diff/1/Source/core/dom/ProcessingIn...
File Source/core/dom/ProcessingInstruction.cpp (right):

https://codereview.chromium.org/579133004/diff/1/Source/core/dom/ProcessingIn...
Source/core/dom/ProcessingInstruction.cpp:221: RefPtr<Document>
protect(&document());
On 2014/09/18 08:55:41, sof wrote:
> Please make it RefPtrWillBeRawPtr<Document> ? :)

Done.

[sof, 2014-09-18 09:51:21]

You wouldn't happen to have the stack when the document is deleted (without this
protection) ?

[tasak, 2014-09-18 09:58:08]

On 2014/09/18 09:51:21, sof wrote:
> You wouldn't happen to have the stack when the document is deleted (without
this
> protection) ?

Yeah.
I think, the document is sometimes destroyed when applying XSLTransform.
If the document is owned by some iframe element and the iframe has been already
removed from document, probably this happens.

[sof, 2014-09-19 07:42:14]

lgtm, let's get this one going.

[tasak, 2014-09-19 08:00:43]

On 2014/09/19 07:42:14, sof wrote:
> lgtm, let's get this one going.

Thank you.

[tasak, 2014-09-19 08:00:46]

The CQ bit was checked by tasak@google.com

[commit-bot: I haz the power, 2014-09-19 08:01:09]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patchset/579133004/20001

[commit-bot: I haz the power, 2014-09-19 09:08:09]

Committed patchset #2 (id:20001) as 182309

[haraken, 2014-09-20 08:09:35]

LGTM