Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 2a20415140e222bcb09da19d5f36494c26c4d715
https://github.com/WebKit/WebKit/commit/2a20415140e222bcb09da19d5f36494c26c4d715
Author: Zak Ridouh <[email protected]>
Date: 2026-09-04 (Fri, 04 Sep 2026)
Changed paths:
M Source/WebCore/testing/Internals.cpp
M Source/WebKit/WebProcess/WebPage/WebPage.cpp
Log Message:
-----------
Null-check history items in history dumping testing code
https://bugs.webkit.org/show_bug.cgi?id=322203
rdar://185442169
Reviewed by David Kilzer.
WebPage::dumpHistoryForTesting() and Internals::getReferencedFilePaths()
dereferenced a nullable history item without checking it.
In dumpHistoryForTesting(), itemAtIndex() takes an offset relative to the
current item, so the range of valid offsets is [-backCount(), forwardCount()]
inclusive. backCount() and forwardCount() are served from a cached value in
WebBackForwardListProxy, while itemAtIndex() is a separate synchronous message
to the UI process, so the bounds and the items are sampled at different times
and itemAtIndex() can return null at an offset the bounds include. Skip those
entries. A page with no current item at all has nothing to dump, so return
early: WebKitTestRunner dumps every page it knows about, and a page created by
window.open() has no current item until its initial load commits.
In getReferencedFilePaths(), only the frame was checked.
HistoryController::currentItem() is null until a load commits, and
saveDocumentAndScrollState() does not create an item.
Both are only reachable from test infrastructure, so this replaces a WebContent
process crash with a skipped entry.
* Source/WebCore/testing/Internals.cpp:
(WebCore::Internals::getReferencedFilePaths const):
* Source/WebKit/WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::dumpHistoryForTesting):
Canonical link: https://commits.webkit.org/320513@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
