Summary: | CRASH in DocumentLoader::removeSubresourceLoader due to null m_frame | ||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Darin Fisher (:fishd, Google) <fishd> | ||||||||||||
Component: | Page Loading | Assignee: | Darin Fisher (:fishd, Google) <fishd> | ||||||||||||
Status: | RESOLVED FIXED | ||||||||||||||
Severity: | Critical | CC: | darin | ||||||||||||
Priority: | P1 | Keywords: | InRadar | ||||||||||||
Version: | 528+ (Nightly build) | ||||||||||||||
Hardware: | All | ||||||||||||||
OS: | All | ||||||||||||||
Attachments: |
|
Description
Darin Fisher (:fishd, Google)
2009-04-10 16:16:59 PDT
Created attachment 29406 [details]
testcase - frame.html
Created attachment 29407 [details]
testcase - careful, this may crash your browser
Created attachment 29412 [details]
patch v1 - simplistic null check
This is a very simple minded solution to the crash. Other parts of DocumentLoader are fairly careful to null test m_frame before using it, and indeed removeSubresourceLoader null checks m_frame before using it (except in the case here where it calls updateLoading).
I have been struggling to get a good layout test for this. For some reason my layout test appears to be rather flakey so I don't want to submit it just yet. I'll keep working on it. I just wanted to share this patch for feedback.
Comment on attachment 29412 [details]
patch v1 - simplistic null check
r=me
If you can figure out how to do a regression test, that would be a great addition. Also, it's much better when there are per-function comments, even for a simple function like this one.
(In reply to comment #4) > Also, it's much better when there are per-function comments, even for > a simple function like this one. Per-function comment in the ChangeLog I mean. > Per-function comment in the ChangeLog I mean.
Will do. I think I figured out how to write a stable test :)
Created attachment 29429 [details]
patch v1 + layout test
This is the same patch as before but now with a layout test. The test requires subframes, so there are a couple resource files included.
Created attachment 29430 [details]
patch v1 + layout test
Take 2. This time with commented out code snippets removed.
Comment on attachment 29430 [details]
patch v1 + layout test
r=me
Landed as: http://trac.webkit.org/changeset/42442 fwiw this is also rdar://6748719 |