Changeset 94721 in webkit

Timestamp:

Sep 7, 2011 3:54:48 PM (13 years ago)

Author:

abarth@webkit.org

Message:

FrameLoader::addExtraFieldsToRequest can crash when called from or after FrameLoader::detachFromParent
​https://bugs.webkit.org/show_bug.cgi?id=61810

Reviewed by Eric Seidel.

Fix this crash as suggested by Darin Fisher in
​https://bugs.webkit.org/show_bug.cgi?id=61810#c21. This patch does not
include the test requested by Alexey Proskuryakov in
​https://bugs.webkit.org/show_bug.cgi?id=61810#c6. I would really much
rather include a test with this patch, but my attempts to write a test
have failed. :(

• src/WebPluginContainerImpl.cpp:

(WebKit::WebPluginContainerImpl::loadFrameRequest):

Location:

trunk/Source/WebKit/chromium

Files:

• ChangeLog (modified) (1 diff)
• src/WebPluginContainerImpl.cpp (modified) (1 diff)

trunk/Source/WebKit/chromium/ChangeLog

@@ +1 @@
+2011-09-07  Adam Barth  <abarth@webkit.org>
+
+        FrameLoader::addExtraFieldsToRequest can crash when called from or after FrameLoader::detachFromParent
+        https://bugs.webkit.org/show_bug.cgi?id=61810
+
+        Reviewed by Eric Seidel.
+
+        Fix this crash as suggested by Darin Fisher in
+        https://bugs.webkit.org/show_bug.cgi?id=61810#c21.  This patch does not
+        include the test requested by Alexey Proskuryakov in
+        https://bugs.webkit.org/show_bug.cgi?id=61810#c6.  I would really much
+        rather include a test with this patch, but my attempts to write a test
+        have failed.  :(
+
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::loadFrameRequest):
+
 2011-09-07  Eric Boren  <borenet@gmail.com>
 

trunk/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp

@@ -387 +387 @@
 {
     Frame* frame = m_element->document()->frame();
-    if (!frame)
+    if (!frame || !frame->loader()->documentLoader())
         return;  // FIXME: send a notification in this case?