Title: [179736] trunk/Source/WebKit2
- Revision
- 179736
- Author
- [email protected]
- Date
- 2015-02-05 18:21:40 -0800 (Thu, 05 Feb 2015)
Log Message
Null deref in ViewGestureController::beginSwipeGesture when swiping while script is navigating
https://bugs.webkit.org/show_bug.cgi?id=141308
<rdar://problem/18460046>
Reviewed by Simon Fraser.
* UIProcess/mac/ViewGestureControllerMac.mm:
(WebKit::ViewGestureController::trackSwipeGesture):
If script navigates (history.back, probably other cases too) while in the middle of
building up enough scroll events to start a swipe, it can destroy the history item
that we were planning to swipe to. If this happens, bail from the swipe.
Modified Paths
Diff
Modified: trunk/Source/WebKit2/ChangeLog (179735 => 179736)
--- trunk/Source/WebKit2/ChangeLog 2015-02-06 02:04:19 UTC (rev 179735)
+++ trunk/Source/WebKit2/ChangeLog 2015-02-06 02:21:40 UTC (rev 179736)
@@ -1,3 +1,17 @@
+2015-02-05 Tim Horton <[email protected]>
+
+ Null deref in ViewGestureController::beginSwipeGesture when swiping while script is navigating
+ https://bugs.webkit.org/show_bug.cgi?id=141308
+ <rdar://problem/18460046>
+
+ Reviewed by Simon Fraser.
+
+ * UIProcess/mac/ViewGestureControllerMac.mm:
+ (WebKit::ViewGestureController::trackSwipeGesture):
+ If script navigates (history.back, probably other cases too) while in the middle of
+ building up enough scroll events to start a swipe, it can destroy the history item
+ that we were planning to swipe to. If this happens, bail from the swipe.
+
2015-02-05 Alexey Proskuryakov <[email protected]>
Don't pass architecture to development plug-in XPC services
Modified: trunk/Source/WebKit2/UIProcess/mac/ViewGestureControllerMac.mm (179735 => 179736)
--- trunk/Source/WebKit2/UIProcess/mac/ViewGestureControllerMac.mm 2015-02-06 02:04:19 UTC (rev 179735)
+++ trunk/Source/WebKit2/UIProcess/mac/ViewGestureControllerMac.mm 2015-02-06 02:21:40 UTC (rev 179736)
@@ -387,6 +387,9 @@
CGFloat maxProgress = (direction == SwipeDirection::Left) ? 1 : 0;
CGFloat minProgress = (direction == SwipeDirection::Right) ? -1 : 0;
RefPtr<WebBackForwardListItem> targetItem = (direction == SwipeDirection::Left) ? m_webPageProxy.backForwardList().backItem() : m_webPageProxy.backForwardList().forwardItem();
+ if (!targetItem)
+ return;
+
__block bool swipeCancelled = false;
ASSERT(!m_swipeCancellationTracker);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
