34722 2010-02-08 13:17:54 -0800 [Chromium] Confirm index is valid in BackForwardListClientImpl::itemAtIndex() before returning non-null 2010-02-10 09:02:15 -0800 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) PC OS X 10.5 RESOLVED FIXED P2 Normal --- 1 japhet japhet scarybeasts oldest_to_newest 188745 0 japhet 2010-02-08 13:17:54 -0800 Chromium bug: http://crbug.com/33929 If a history.forward() call occurs, for example, at the start of a page load, we will end up cancelling the original load because itemAtIndex() is returning non-null even though the forward list is empty. 188754 1 48364 japhet 2010-02-08 13:52:44 -0800 Created attachment 48364 patch 188758 2 48364 fishd 2010-02-08 14:00:45 -0800 Comment on attachment 48364 patch Please add a link to this bug in the ChangeLog entry. > Index: WebKit/chromium/src/BackForwardListClientImpl.cpp > =================================================================== > --- WebKit/chromium/src/BackForwardListClientImpl.cpp (revision 54505) > +++ WebKit/chromium/src/BackForwardListClientImpl.cpp (working copy) > @@ -90,7 +90,7 @@ > > HistoryItem* BackForwardListClientImpl::itemAtIndex(int index) > { > - if (!m_webView->client()) > + if (!m_webView->client() || index > forwardListCount() || index < (backListCount() * -1)) It might read slightly better as: if (!m_webView->client() || index > forwardListCount() || -index > backListCount()) Either way, R=me Please file a bug about adding a layout test per our discussion. For those reading at home, Nate's initial attempts at creating a test didn't pan out, and this bug is a release blocker for Chrome, so we are splitting the task into two bugs. He'll work on completing the layout test next. 188769 3 48364 japhet 2010-02-08 14:47:50 -0800 Comment on attachment 48364 patch http://trac.webkit.org/changeset/54511 If it's alright, I'll leave this bug open for the layout test that I will be submitting ASAP. 188784 4 48364 eric 2010-02-08 15:12:15 -0800 Comment on attachment 48364 patch Cleared Darin Fisher's review+ from obsolete attachment 48364 so that this bug does not appear in http://webkit.org/pending-commit. 188818 5 48375 japhet 2010-02-08 16:25:10 -0800 Created attachment 48375 layout test Sorry for the delay in getting this test out. 188835 6 scarybeasts 2010-02-08 17:07:52 -0800 Do we know what revision broke this? 189124 7 48375 abarth 2010-02-09 12:31:02 -0800 Comment on attachment 48375 layout test I support all passing tests. 189386 8 japhet 2010-02-10 09:02:15 -0800 http://trac.webkit.org/changeset/54600 48364 2010-02-08 13:52:44 -0800 2010-02-08 15:12:14 -0800 patch patch.txt text/plain 1202 japhet SW5kZXg6IFdlYktpdC9jaHJvbWl1bS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViS2l0L2No cm9taXVtL0NoYW5nZUxvZwkocmV2aXNpb24gNTQ1MDYpCisrKyBXZWJLaXQvY2hyb21pdW0vQ2hh bmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTMgQEAKKzIwMTAtMDItMDggIE5hdGUg Q2hhcGluICA8amFwaGV0QGNocm9taXVtLm9yZz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP RFkgKE9PUFMhKS4KKworICAgICAgICBDaGVjayB0aGF0IHRoZSBpbmRleCBwYXNzZWQgaW50byBC YWNrRm9yd2FyZExpc3RDbGllbnRJbXBsOjppdGVtQXRJbmRleCgpCisgICAgICAgIGlzIHZhbGlk LCBhbmQgcmV0dXJuIG51bGwgaWYgaXQgaXNuJ3QuCisKKyAgICAgICAgKiBzcmMvQmFja0Zvcndh cmRMaXN0Q2xpZW50SW1wbC5jcHA6CisgICAgICAgIChXZWJLaXQ6OkJhY2tGb3J3YXJkTGlzdENs aWVudEltcGw6Oml0ZW1BdEluZGV4KToKKwogMjAxMC0wMi0wNSAgRHVtaXRydSBEYW5pbGl1YyAg PGR1bWlAY2hyb21pdW0ub3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IEplcmVteSBPcmxvdy4K SW5kZXg6IFdlYktpdC9jaHJvbWl1bS9zcmMvQmFja0ZvcndhcmRMaXN0Q2xpZW50SW1wbC5jcHAK PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PQotLS0gV2ViS2l0L2Nocm9taXVtL3NyYy9CYWNrRm9yd2FyZExpc3RDbGllbnRJ bXBsLmNwcAkocmV2aXNpb24gNTQ1MDUpCisrKyBXZWJLaXQvY2hyb21pdW0vc3JjL0JhY2tGb3J3 YXJkTGlzdENsaWVudEltcGwuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC05MCw3ICs5MCw3IEBACiAK IEhpc3RvcnlJdGVtKiBCYWNrRm9yd2FyZExpc3RDbGllbnRJbXBsOjppdGVtQXRJbmRleChpbnQg aW5kZXgpCiB7Ci0gICAgaWYgKCFtX3dlYlZpZXctPmNsaWVudCgpKQorICAgIGlmICghbV93ZWJW aWV3LT5jbGllbnQoKSB8fCBpbmRleCA+IGZvcndhcmRMaXN0Q291bnQoKSB8fCBpbmRleCA8IChi YWNrTGlzdENvdW50KCkgKiAtMSkpCiAgICAgICAgIHJldHVybiAwOwogCiAgICAgLy8gU2luY2Ug d2UgZG9uJ3Qga2VlcCB0aGUgZW50aXJlIGJhY2svZm9yd2FyZCBsaXN0LCB3ZSBoYXZlIG5vIHdh eSB0bwo= 48375 2010-02-08 16:25:10 -0800 2010-02-09 12:31:01 -0800 layout test patch.txt text/plain 1645 japhet SW5kZXg6IExheW91dFRlc3RzL2Zhc3QvaGlzdG9yeS9mb3J3YXJkLWR1cmluZy1sb2FkLWV4cGVj dGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L2hpc3RvcnkvZm9yd2FyZC1k dXJpbmctbG9hZC1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9mYXN0 L2hpc3RvcnkvZm9yd2FyZC1kdXJpbmctbG9hZC1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCkBA IC0wLDAgKzEgQEAKK1BBU1MgQ2FsbGluZyBoaXN0b3J5LmZvcndhcmQoKSBhYm92ZSBzaG91bGRu J3QgcHJldmVudCB0aGUgcmVzdCBvZiB0aGUgcGFnZSBmcm9tIGxvYWRpbmcuCkluZGV4OiBMYXlv dXRUZXN0cy9mYXN0L2hpc3RvcnkvZm9yd2FyZC1kdXJpbmctbG9hZC5odG1sCj09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K LS0tIExheW91dFRlc3RzL2Zhc3QvaGlzdG9yeS9mb3J3YXJkLWR1cmluZy1sb2FkLmh0bWwJKHJl dmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9mYXN0L2hpc3RvcnkvZm9yd2FyZC1kdXJpbmctbG9h ZC5odG1sCShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDEyIEBACis8aHRtbD4KKzxoZWFkPgorPHNj cmlwdD4KK2lmICh3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIpCisgICAgbGF5b3V0VGVzdENv bnRyb2xsZXIuZHVtcEFzVGV4dCgpOworaGlzdG9yeS5mb3J3YXJkKCk7Cis8L3NjcmlwdD4KKzwv aGVhZD4KKzxib2R5PgorUEFTUyBDYWxsaW5nIGhpc3RvcnkuZm9yd2FyZCgpIGFib3ZlIHNob3Vs ZG4ndCBwcmV2ZW50IHRoZSByZXN0IG9mIHRoZSBwYWdlIGZyb20gbG9hZGluZy4KKzwvYm9keT4K KzwvaHRtbD4KSW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlv dXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDU0NTE4KQorKysgTGF5b3V0VGVzdHMvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTYgQEAKKzIwMTAtMDItMDggIE5hdGUgQ2hh cGluICA8amFwaGV0QGNocm9taXVtLm9yZz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkg KE9PUFMhKS4KKworICAgICAgICBBZGQgdGVzdCB0byBlbnN1cmUgdGhhdCBhIGNhbGwgdG8gaGlz dG9yeS5mb3J3YXJkKCkgYXQgdGhlIHRvcCBvZgorICAgICAgICBhIHBhZ2UgZG9lc24ndCBwcmV2 ZW50IHRoZSBwYWdlIGZyb20gbG9hZGluZyB3aGVuIHRoZXJlIGlzIG5vCisgICAgICAgIGZvcndh cmQgbGlzdC4KKworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/ aWQ9MzQ3MjIKKworICAgICAgICAqIGZhc3QvaGlzdG9yeS9mb3J3YXJkLWR1cmluZy1sb2FkLWV4 cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogZmFzdC9oaXN0b3J5L2ZvcndhcmQtZHVyaW5n LWxvYWQuaHRtbDogQWRkZWQuCisKIDIwMTAtMDItMDggIEFsZXhleSBQcm9za3VyeWFrb3YgIDxh cEBhcHBsZS5jb20+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgRGFyaW4gQWRsZXIuCg==