Bug 115498

Summary: Null check plugInClient earlier in snapshotting path
Product: WebKit Reporter: Joseph Pecoraro <joepeck>
Component: Plug-insAssignee: Joseph Pecoraro <joepeck>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, dino, esprehn+autocc, thorton
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
[PATCH] Proposed Fix none

Description Joseph Pecoraro 2013-05-01 16:24:12 PDT
If autostartOriginPlugInSnapshottingEnabled is enabled and there is no pluginClient snapshotting crashes. Add a null check to avoid a crash. Later on in the function there is a null check for this pluginClient as well.
Comment 1 Joseph Pecoraro 2013-05-01 16:27:25 PDT
Created attachment 200252 [details]
[PATCH] Proposed Fix

I'm not very familiar with this path, but this crash certainly seems possible (a port that doesn't set a plugin in client but has snapshotting enabled because the Setting is enabled by default). We should be resilient in such cases and not crash. Maybe it makes sense to ASSERT at some other point that a plugin client is set.
Comment 2 Darin Adler 2013-05-01 17:10:31 PDT
Comment on attachment 200252 [details]
[PATCH] Proposed Fix

View in context: https://bugs.webkit.org/attachment.cgi?id=200252&action=review

> Source/WebCore/html/HTMLPlugInImageElement.cpp:648
> -    if (document()->page()->settings()->autostartOriginPlugInSnapshottingEnabled() && document()->page()->plugInClient()->shouldAutoStartFromOrigin(document()->page()->mainFrame()->document()->baseURL().host(), url.host(), loadedMimeType())) {
> +    if (document()->page()->settings()->autostartOriginPlugInSnapshottingEnabled() && document()->page()->plugInClient() && document()->page()->plugInClient()->shouldAutoStartFromOrigin(document()->page()->mainFrame()->document()->baseURL().host(), url.host(), loadedMimeType())) {

I think this would be way better with some local variables. One for document()->page() and another for document()->page()->plugInClient().
Comment 3 WebKit Commit Bot 2013-05-01 17:39:26 PDT
Comment on attachment 200252 [details]
[PATCH] Proposed Fix

Clearing flags on attachment: 200252

Committed r149469: <http://trac.webkit.org/changeset/149469>
Comment 4 WebKit Commit Bot 2013-05-01 17:39:28 PDT
All reviewed patches have been landed.  Closing bug.