Changeset 49627 in webkit

Timestamp:

Oct 15, 2009 7:56:19 AM (15 years ago)

Author:

kov@webkit.org

Message:

2009-10-15 Gustavo Noronha Silva <​gustavo.noronha@collabora.co.uk>

Reviewed by Xan Lopez.

page transition may crash webkit
​https://bugs.webkit.org/show_bug.cgi?id=29890

There are actually cases in which a resource may be asked using
webkit_web_view_get_resource after a new load has already been
started, so protect ourselves from crashes in this case.

• WebCoreSupport/FrameLoaderClientGtk.cpp: (WebKit::FrameLoaderClient::dispatchDidFinishLoading):
• webkit/webkitwebview.cpp: (webkit_web_view_get_resource):

Location:

trunk/WebKit/gtk

Files:

• ChangeLog (modified) (1 diff)
• WebCoreSupport/FrameLoaderClientGtk.cpp (modified) (1 diff)
• webkit/webkitwebview.cpp (modified) (1 diff)

trunk/WebKit/gtk/ChangeLog

@@ +1 @@
+2009-10-15  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        page transition may crash webkit
+        https://bugs.webkit.org/show_bug.cgi?id=29890
+
+        There are actually cases in which a resource may be asked using
+        webkit_web_view_get_resource after a new load has already been
+        started, so protect ourselves from crashes in this case.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::dispatchDidFinishLoading):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_get_resource):
+
 2009-10-12  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 

trunk/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp

@@ -848 +848 @@
     WebKitWebResource* webResource = webkit_web_view_get_resource(webView, identifierString.get());
 
+    // A NULL WebResource means the load has been interrupted, and
+    // replaced by another one while this resource was being loaded.
+    if (!webResource)
+        return;
+
     const char* uri = webkit_web_resource_get_uri(webResource);
     RefPtr<ArchiveResource> coreResource(loader->subresource(KURL(KURL(), uri)));

trunk/WebKit/gtk/webkit/webkitwebview.cpp

@@ -3894 +3894 @@
     gboolean resourceFound = g_hash_table_lookup_extended(priv->subResources, identifier, NULL, &webResource);
 
-    // The only resource we do not store in this hash table is the main!
-    g_return_val_if_fail(resourceFound || g_str_equal(identifier, priv->mainResourceIdentifier), NULL);
+    // The only resource we do not store in this hash table is the
+    // main!  If we did not find a request, it probably means the load
+    // has been interrupted while while a resource was still being
+    // loaded.
+    if (!resourceFound && !g_str_equal(identifier, priv->mainResourceIdentifier))
+        return NULL;
 
     if (!webResource)