Title: [127021] branches/safari-536.26-branch/Source/WebCore
- Revision
- 127021
- Author
- [email protected]
- Date
- 2012-08-29 11:08:32 -0700 (Wed, 29 Aug 2012)
Log Message
Merge r126921 for <rdar://problem/12117040>.
Modified Paths
Diff
Modified: branches/safari-536.26-branch/Source/WebCore/ChangeLog (127020 => 127021)
--- branches/safari-536.26-branch/Source/WebCore/ChangeLog 2012-08-29 17:59:09 UTC (rev 127020)
+++ branches/safari-536.26-branch/Source/WebCore/ChangeLog 2012-08-29 18:08:32 UTC (rev 127021)
@@ -1,3 +1,20 @@
+2012-08-29 Timothy Hatcher <[email protected]>
+
+ Merge r126921.
+
+ 2012-08-29 Jer Noble <[email protected]>
+
+ Crash in WebCore::logPluginRequest + 183
+ https://bugs.webkit.org/show_bug.cgi?id=95218
+
+ Reviewed by Oliver Hunt.
+
+ Crash is within findPluginMIMETypeFromURL, caused by a null-dereference of
+ page()->pluginData(). Add a null-check and return an empty string.
+
+ * loader/SubframeLoader.cpp:
+ (WebCore::findPluginMIMETypeFromURL):
+
2012-08-20 Mark Rowe <[email protected]>
Merge r122354.
Modified: branches/safari-536.26-branch/Source/WebCore/loader/SubframeLoader.cpp (127020 => 127021)
--- branches/safari-536.26-branch/Source/WebCore/loader/SubframeLoader.cpp 2012-08-29 17:59:09 UTC (rev 127020)
+++ branches/safari-536.26-branch/Source/WebCore/loader/SubframeLoader.cpp 2012-08-29 18:08:32 UTC (rev 127021)
@@ -146,6 +146,9 @@
String extension = url.substring(dotIndex + 1);
PluginData* pluginData = page->pluginData();
+ if (!pluginData)
+ return String();
+
for (size_t i = 0; i < pluginData->mimes().size(); ++i) {
const MimeClassInfo& mimeClassInfo = pluginData->mimes()[i];
for (size_t j = 0; j < mimeClassInfo.extensions.size(); ++j) {
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
