Changeset 128972 in webkit

Timestamp:

Sep 19, 2012 12:20:40 AM (12 years ago)

Author:

tkent@chromium.org

Message:

[Chromium] Fix crash in WebFrameImpl::loadHistoryItem
​https://bugs.webkit.org/show_bug.cgi?id=96352

Reviewed by Adam Barth.

We have some crash reports with the following stack:

• HistoryItem::shouldDoSameDocumentNavigationTo.
• WebFrameImpl::loadHistoryItem ...

We don't have reproducible steps, and not sure what's the root
cause. Anyway we should check nullness of currentItem because
HistoryController::m_currentItem can be 0.

• src/WebFrameImpl.cpp:

(WebKit::WebFrameImpl::loadHistoryItem):
Check nullness of currentItem.

Location:

trunk/Source/WebKit/chromium

Files:

• ChangeLog (modified) (1 diff)
• src/WebFrameImpl.cpp (modified) (1 diff)

trunk/Source/WebKit/chromium/ChangeLog

@@ +1 @@
+2012-09-19  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium] Fix crash in WebFrameImpl::loadHistoryItem
+        https://bugs.webkit.org/show_bug.cgi?id=96352
+
+        Reviewed by Adam Barth.
+
+        We have some crash reports with the following stack:
+          - HistoryItem::shouldDoSameDocumentNavigationTo.
+          - WebFrameImpl::loadHistoryItem
+          ...
+
+        We don't have reproducible steps, and not sure what's the root
+        cause. Anyway we should check nullness of currentItem because
+        HistoryController::m_currentItem can be 0.
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::loadHistoryItem):
+        Check nullness of currentItem.
+
 2012-09-18  Sailesh Agrawal  <sail@chromium.org>
 

trunk/Source/WebKit/chromium/src/WebFrameImpl.cpp

@@ -1030 +1030 @@
     m_frame->loader()->prepareForHistoryNavigation();
     RefPtr<HistoryItem> currentItem = m_frame->loader()->history()->currentItem();
-    m_inSameDocumentHistoryLoad = currentItem->shouldDoSameDocumentNavigationTo(historyItem.get());
+    m_inSameDocumentHistoryLoad = currentItem && currentItem->shouldDoSameDocumentNavigationTo(historyItem.get());
     m_frame->page()->goToItem(historyItem.get(),
                               FrameLoadTypeIndexedBackForward);