Changeset 186969 in webkit

Timestamp:

Jul 17, 2015 4:05:27 PM (9 years ago)

Author:

mitz@apple.com

Message:

REGRESSION (r186964): Crash in WebKit2.CloseFromWithinCreatePage
​https://bugs.webkit.org/show_bug.cgi?id=147055

Reviewed by Alex Christensen.

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::createNewPage): Grab the main frame’s URL before calling out to the
client, who may destroy the frame.

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/WebPageProxy.cpp (modified) (2 diffs)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2015-07-17  Dan Bernstein  <mitz@apple.com>
+
+        REGRESSION (r186964): Crash in WebKit2.CloseFromWithinCreatePage
+        https://bugs.webkit.org/show_bug.cgi?id=147055
+
+        Reviewed by Alex Christensen.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::createNewPage): Grab the main frame’s URL before calling out to the
+        client, who may destroy the frame.
+
 2015-07-17  Dan Bernstein  <mitz@apple.com>
 

trunk/Source/WebKit2/UIProcess/WebPageProxy.cpp

@@ -3527 +3527 @@
     MESSAGE_CHECK(frame);
 
+    auto mainFrameURL = m_mainFrame->url();
+
     RefPtr<WebPageProxy> newPage = m_uiClient->createNewPage(this, frame, securityOriginData, request, windowFeatures, navigationActionData);
     if (!newPage) {
@@ -3537 +3539 @@
 
     WebsiteDataStore::cloneSessionData(*this, *newPage);
-    newPage->m_shouldSuppressAppLinksInNextNavigationPolicyDecision = protocolHostAndPortAreEqual(URL(ParsedURLString, m_mainFrame->url()), request.url());
+    newPage->m_shouldSuppressAppLinksInNextNavigationPolicyDecision = protocolHostAndPortAreEqual(URL(ParsedURLString, mainFrameURL), request.url());
 }