Title: [98389] trunk/Source/WebCore
- Revision
- 98389
- Author
- [email protected]
- Date
- 2011-10-25 13:46:14 -0700 (Tue, 25 Oct 2011)
Log Message
REGRESSION(97821): HistoryController::itemsAreClones crashes a lot
https://bugs.webkit.org/show_bug.cgi?id=70827
<rdar://problem/10342925>
Reviewed by Adam Barth.
Check that m_currentItem is non-null before passing it to itemsAreClones. While I wasn't
able to make a test case that would reproduce this crash, we do check m_currentItem for null
everywhere else, and the crash log indicates that this would fix the crash.
* loader/HistoryController.cpp:
(WebCore::HistoryController::recursiveUpdateForCommit):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (98388 => 98389)
--- trunk/Source/WebCore/ChangeLog 2011-10-25 20:44:03 UTC (rev 98388)
+++ trunk/Source/WebCore/ChangeLog 2011-10-25 20:46:14 UTC (rev 98389)
@@ -1,3 +1,18 @@
+2011-10-25 Anders Carlsson <[email protected]>
+
+ REGRESSION(97821): HistoryController::itemsAreClones crashes a lot
+ https://bugs.webkit.org/show_bug.cgi?id=70827
+ <rdar://problem/10342925>
+
+ Reviewed by Adam Barth.
+
+ Check that m_currentItem is non-null before passing it to itemsAreClones. While I wasn't
+ able to make a test case that would reproduce this crash, we do check m_currentItem for null
+ everywhere else, and the crash log indicates that this would fix the crash.
+
+ * loader/HistoryController.cpp:
+ (WebCore::HistoryController::recursiveUpdateForCommit):
+
2011-10-25 Adam Barth <[email protected]>
EventTarget.h shouldn't need to know about every feature and ifdef
Modified: trunk/Source/WebCore/loader/HistoryController.cpp (98388 => 98389)
--- trunk/Source/WebCore/loader/HistoryController.cpp 2011-10-25 20:44:03 UTC (rev 98388)
+++ trunk/Source/WebCore/loader/HistoryController.cpp 2011-10-25 20:46:14 UTC (rev 98389)
@@ -472,7 +472,7 @@
// For each frame that already had the content the item requested (based on
// (a matching URL and frame tree snapshot), just restore the scroll position.
// Save form state (works from currentItem, since m_frameLoadComplete is true)
- if (itemsAreClones(m_currentItem.get(), m_provisionalItem.get())) {
+ if (m_currentItem && itemsAreClones(m_currentItem.get(), m_provisionalItem.get())) {
ASSERT(m_frameLoadComplete);
saveDocumentState();
saveScrollPositionAndViewStateToItem(m_currentItem.get());
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
