Fix memory issues related to preload eviction.

https://bugs.webkit.org/show_bug.cgi?id=167838

Reviewed by Andreas Kling.

This avoids removing resources from m_preloads during the iteration
by creating a second HashSetList containing the remaining link preloads.

No new tests but this will fix crashes on the leak bots.

* loader/cache/CachedResourceLoader.cpp:
(WebCore::CachedResourceLoader::clearPreloads):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@211673 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Author: [email protected]

Source/WebCore/ChangeLog

@@ -1,3 +1,18 @@
+2017-02-04  Yoav Weiss  <[email protected]>
+
+        Fix memory issues related to preload eviction.
+        https://bugs.webkit.org/show_bug.cgi?id=167838
+
+        Reviewed by Andreas Kling.
+
+        This avoids removing resources from m_preloads during the iteration
+        by creating a second HashSetList containing the remaining link preloads.
+
+        No new tests but this will fix crashes on the leak bots.
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::clearPreloads):
+
 2017-02-04  Zalan Bujtas  <[email protected]>
 
         Simple line layout: Skip 16bit specific checks on 8bit content.

Source/WebCore/loader/cache/CachedResourceLoader.cpp

@@ -1254,17 +1254,21 @@ void CachedResourceLoader::clearPreloads(ClearPreloadsMode mode)
     if (!m_preloads)
         return;
 
+    std::unique_ptr<ListHashSet<CachedResource*>> remainingLinkPreloads;
     for (auto* resource : *m_preloads) {
-        if (mode == ClearPreloadsMode::ClearSpeculativePreloads && resource->isLinkPreload())
+        ASSERT(resource);
+        if (mode == ClearPreloadsMode::ClearSpeculativePreloads && resource->isLinkPreload()) {
+            if (!remainingLinkPreloads)
+                remainingLinkPreloads = std::make_unique<ListHashSet<CachedResource*>>();
+            remainingLinkPreloads->add(resource);
             continue;
+        }
         resource->decreasePreloadCount();
         bool deleted = resource->deleteIfPossible();
         if (!deleted && resource->preloadResult() == CachedResource::PreloadNotReferenced)
             MemoryCache::singleton().remove(*resource);
-        m_preloads->remove(resource);
     }
-    if (!m_preloads->size())
-        m_preloads = nullptr;
+    m_preloads = WTFMove(remainingLinkPreloads);
 }
 
 #if PRELOAD_DEBUG