Changeset 179736 in webkit

Timestamp:

Feb 5, 2015, 6:21:40 PM (12 years ago)

Author:

timothy_horton@apple.com

Message:

Null deref in ViewGestureController::beginSwipeGesture when swiping while script is navigating
​https://bugs.webkit.org/show_bug.cgi?id=141308
<rdar://problem/18460046>

Reviewed by Simon Fraser.

• UIProcess/mac/ViewGestureControllerMac.mm:

(WebKit::ViewGestureController::trackSwipeGesture):
If script navigates (history.back, probably other cases too) while in the middle of
building up enough scroll events to start a swipe, it can destroy the history item
that we were planning to swipe to. If this happens, bail from the swipe.

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/mac/ViewGestureControllerMac.mm (modified) (1 diff)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2015-02-05  Tim Horton  <timothy_horton@apple.com>
+
+        Null deref in ViewGestureController::beginSwipeGesture when swiping while script is navigating
+        https://bugs.webkit.org/show_bug.cgi?id=141308
+        <rdar://problem/18460046>
+
+        Reviewed by Simon Fraser.
+
+        * UIProcess/mac/ViewGestureControllerMac.mm:
+        (WebKit::ViewGestureController::trackSwipeGesture):
+        If script navigates (history.back, probably other cases too) while in the middle of
+        building up enough scroll events to start a swipe, it can destroy the history item
+        that we were planning to swipe to. If this happens, bail from the swipe.
+
 2015-02-05  Alexey Proskuryakov  <ap@apple.com>
 

trunk/Source/WebKit2/UIProcess/mac/ViewGestureControllerMac.mm

@@ -388 +388 @@
     CGFloat minProgress = (direction == SwipeDirection::Right) ? -1 : 0;
     RefPtr<WebBackForwardListItem> targetItem = (direction == SwipeDirection::Left) ? m_webPageProxy.backForwardList().backItem() : m_webPageProxy.backForwardList().forwardItem();
+    if (!targetItem)
+        return;
+    
     __block bool swipeCancelled = false;