Changeset 152367 in webkit

Timestamp:

Jul 3, 2013 10:35:13 AM (11 years ago)

Author:

sergio@webkit.org

Message:

[GTK][WK2] SIGSEV in WebKit::WebPageContextMenuClient::customContextMenuItemSelected
​https://bugs.webkit.org/show_bug.cgi?id=116867

Reviewed by Anders Carlsson.

We did not reset the clients on WebPageProxy::close(), so right
clicking on a link after starting the navigation to some other
page was causing crashes because code was trying to access an
already freed m_contextMenuClient.

There were some other clients that could potentially trigger the
same issues. Reset them all to null to prevent this situation.

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::close):

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/WebPageProxy.cpp (modified) (1 diff)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2013-07-03  Sergio Villar Senin  <svillar@igalia.com>
+
+        [GTK][WK2] SIGSEV in WebKit::WebPageContextMenuClient::customContextMenuItemSelected
+        https://bugs.webkit.org/show_bug.cgi?id=116867
+
+        Reviewed by Anders Carlsson.
+
+        We did not reset the clients on WebPageProxy::close(), so right
+        clicking on a link after starting the navigation to some other
+        page was causing crashes because code was trying to access an
+        already freed m_contextMenuClient.
+
+        There were some other clients that could potentially trigger the
+        same issues. Reset them all to null to prevent this situation.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::close):
+
 2013-07-03  Simon Pena  <simon.pena@samsung.com>
 

trunk/Source/WebKit2/UIProcess/WebPageProxy.cpp

@@ -630 +630 @@
 
     m_estimatedProgress = 0.0;
-    
+
     m_loaderClient.initialize(0);
     m_policyClient.initialize(0);
+    m_formClient.initialize(0);
     m_uiClient.initialize(0);
 #if PLATFORM(EFL)
     m_uiPopupMenuClient.initialize(0);
+#endif
+    m_findClient.initialize(0);
+    m_findMatchesClient.initialize(0);
+#if ENABLE(CONTEXT_MENUS)
+    m_contextMenuClient.initialize(0);
 #endif