Changeset 98389 in webkit

Timestamp:

Oct 25, 2011, 1:46:14 PM (15 years ago)

Author:

andersca@apple.com

Message:

REGRESSION(97821): HistoryController::itemsAreClones crashes a lot
​https://bugs.webkit.org/show_bug.cgi?id=70827
<rdar://problem/10342925>

Reviewed by Adam Barth.

Check that m_currentItem is non-null before passing it to itemsAreClones. While I wasn't
able to make a test case that would reproduce this crash, we do check m_currentItem for null
everywhere else, and the crash log indicates that this would fix the crash.

• loader/HistoryController.cpp:

(WebCore::HistoryController::recursiveUpdateForCommit):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• loader/HistoryController.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-10-25  Anders Carlsson  <andersca@apple.com>
+
+        REGRESSION(97821): HistoryController::itemsAreClones crashes a lot
+        https://bugs.webkit.org/show_bug.cgi?id=70827
+        <rdar://problem/10342925>
+
+        Reviewed by Adam Barth.
+
+        Check that m_currentItem is non-null before passing it to itemsAreClones. While I wasn't
+        able to make a test case that would reproduce this crash, we do check m_currentItem for null
+        everywhere else, and the crash log indicates that this would fix the crash.
+
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::recursiveUpdateForCommit):
+
 2011-10-25  Adam Barth  <abarth@webkit.org>
 

trunk/Source/WebCore/loader/HistoryController.cpp

@@ -473 +473 @@
     // (a matching URL and frame tree snapshot), just restore the scroll position.
     // Save form state (works from currentItem, since m_frameLoadComplete is true)
-    if (itemsAreClones(m_currentItem.get(), m_provisionalItem.get())) {
+    if (m_currentItem && itemsAreClones(m_currentItem.get(), m_provisionalItem.get())) {
         ASSERT(m_frameLoadComplete);
         saveDocumentState();