Bug 168608 - Nullptr dereferences when stopping a load
Summary: Nullptr dereferences when stopping a load
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Page Loading (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Brent Fulgham
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2017-02-20 12:04 PST by Brent Fulgham
Modified: 2017-02-20 13:00 PST (History)
8 users (show)

See Also:

Attachments
Patch (3.09 KB, patch)
2017-02-20 12:09 PST, Brent Fulgham 		rniwa: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Brent Fulgham 2017-02-20 12:04:48 PST 
We have seen crash traces that indicate the frame is being detached from the document while stopping a load, leading to nullptr dereferences and crashes.

Other loading code anticipates the possibility the the frame is nullptr. Since these crashes are happening at the tail end of the load termination, when attempting to notify the now-detached client that the load was stopped, we should probably just recognize this is happening and avoid the dereference.
Comment 1 Brent Fulgham 2017-02-20 12:09:06 PST 
Created attachment 302163 [details]
Patch
Comment 2 Ryosuke Niwa 2017-02-20 12:14:08 PST 
Comment on attachment 302163 [details]
Patch

r=me. It's sad we can't have a test for this.
Comment 3 Brent Fulgham 2017-02-20 12:59:44 PST 
Committed r212667: <http://trac.webkit.org/changeset/212667>
Comment 4 Brent Fulgham 2017-02-20 13:00:52 PST 
<rdar://problem/29852056>