Title: [222163] trunk/Source/WebCore
Revision
222163
Author
[email protected]
Date
2017-09-18 11:01:48 -0700 (Mon, 18 Sep 2017)

Log Message

[WK1] Layout Test fast/events/beforeunload-dom-manipulation-crash.html is crashing.
https://bugs.webkit.org/show_bug.cgi?id=177071

Reviewed by Brent Fulgham.

The Page pointer in the history controller's frame is null. Add a null pointer check before
accessing the page.

No new tests, covered by exiting tests.

* loader/HistoryController.cpp:
(WebCore::HistoryController::updateForStandardLoad):
(WebCore::HistoryController::updateForRedirectWithLockedBackForwardList):
(WebCore::HistoryController::updateForClientRedirect):

Modified Paths

Diff

Modified: trunk/Source/WebCore/ChangeLog (222162 => 222163)


--- trunk/Source/WebCore/ChangeLog	2017-09-18 17:54:08 UTC (rev 222162)
+++ trunk/Source/WebCore/ChangeLog	2017-09-18 18:01:48 UTC (rev 222163)
@@ -1,3 +1,20 @@
+2017-09-18  Per Arne Vollan  <[email protected]>
+
+        [WK1] Layout Test fast/events/beforeunload-dom-manipulation-crash.html is crashing.
+        https://bugs.webkit.org/show_bug.cgi?id=177071
+
+        Reviewed by Brent Fulgham.
+
+        The Page pointer in the history controller's frame is null. Add a null pointer check before
+        accessing the page. 
+
+        No new tests, covered by exiting tests.
+
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateForStandardLoad):
+        (WebCore::HistoryController::updateForRedirectWithLockedBackForwardList):
+        (WebCore::HistoryController::updateForClientRedirect):
+
 2017-09-17  Carlos Garcia Campos  <[email protected]>
 
         REGRESSION(r221974): [Harfbuzz] Test fast/text/international/hebrew-selection.html is failing since r221974

Modified: trunk/Source/WebCore/loader/HistoryController.cpp (222162 => 222163)


--- trunk/Source/WebCore/loader/HistoryController.cpp	2017-09-18 17:54:08 UTC (rev 222162)
+++ trunk/Source/WebCore/loader/HistoryController.cpp	2017-09-18 18:01:48 UTC (rev 222163)
@@ -381,7 +381,7 @@
 
     FrameLoader& frameLoader = m_frame.loader();
 
-    bool needPrivacy = m_frame.page()->usesEphemeralSession();
+    bool needPrivacy = m_frame.page() ? m_frame.page()->usesEphemeralSession() : true;
     const URL& historyURL = frameLoader.documentLoader()->urlForHistory();
 
     if (!frameLoader.documentLoader()->isClientRedirect()) {
@@ -415,7 +415,7 @@
 {
     LOG(History, "HistoryController %p updateForRedirectWithLockedBackForwardList: Updating History for redirect load in frame %p (main frame %d) %s", this, &m_frame, m_frame.isMainFrame(), m_frame.loader().documentLoader() ? m_frame.loader().documentLoader()->url().string().utf8().data() : "");
     
-    bool needPrivacy = m_frame.page()->usesEphemeralSession();
+    bool needPrivacy = m_frame.page() ? m_frame.page()->usesEphemeralSession() : true;
     const URL& historyURL = m_frame.loader().documentLoader()->urlForHistory();
 
     if (m_frame.loader().documentLoader()->isClientRedirect()) {
@@ -460,7 +460,7 @@
         m_currentItem->clearScrollPosition();
     }
 
-    bool needPrivacy = m_frame.page()->usesEphemeralSession();
+    bool needPrivacy = m_frame.page() ? m_frame.page()->usesEphemeralSession() : true;
     const URL& historyURL = m_frame.loader().documentLoader()->urlForHistory();
 
     if (!historyURL.isEmpty() && !needPrivacy) {
@@ -549,13 +549,13 @@
     if (m_frame.document()->url().isEmpty())
         return;
 
-    if (m_frame.page()->usesEphemeralSession())
-        return;
-
     Page* page = m_frame.page();
     if (!page)
         return;
 
+    if (page->usesEphemeralSession())
+        return;
+
     addVisitedLink(*page, m_frame.document()->url());
     m_frame.mainFrame().loader().history().recursiveUpdateForSameDocumentNavigation();
 
@@ -893,10 +893,10 @@
     m_currentItem->setFormData(nullptr);
     m_currentItem->setFormContentType(String());
 
+    ASSERT(m_frame.page());
     if (m_frame.page()->usesEphemeralSession())
         return;
 
-    ASSERT(m_frame.page());
     addVisitedLink(*m_frame.page(), URL(ParsedURLString, urlString));
     m_frame.loader().client().updateGlobalHistory();
 }
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to