Modified: trunk/Source/WebKit2/ChangeLog (199026 => 199027)
--- trunk/Source/WebKit2/ChangeLog 2016-04-04 22:17:22 UTC (rev 199026)
+++ trunk/Source/WebKit2/ChangeLog 2016-04-04 22:28:05 UTC (rev 199027)
@@ -1,3 +1,17 @@
+2016-04-04 Jiewen Tan <[email protected]>
+
+ Tapping on tabs in webpages caused WK crash at WebKit: WebKit::WebFrame::didReceivePolicyDecision
+ https://bugs.webkit.org/show_bug.cgi?id=156119
+ <rdar://problem/20732167>
+
+ Reviewed by Andy Estes.
+
+ Protect the m_frame so that it is present for completion handlers.
+
+ * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+ (WebKit::WebFrameLoaderClient::dispatchDecidePolicyForResponse):
+ (WebKit::WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction):
+
2016-04-04 Beth Dakin <[email protected]>
Add some logic to decide when a video can control the videoControlsManager
Modified: trunk/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp (199026 => 199027)
--- trunk/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp 2016-04-04 22:17:22 UTC (rev 199026)
+++ trunk/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp 2016-04-04 22:28:05 UTC (rev 199027)
@@ -707,7 +707,8 @@
uint64_t policyAction;
DownloadID downloadID;
- WebCore::Frame* coreFrame = m_frame ? m_frame->coreFrame() : nullptr;
+ Ref<WebFrame> protect(*m_frame);
+ WebCore::Frame* coreFrame = m_frame->coreFrame();
if (!webPage->sendSync(Messages::WebPageProxy::DecidePolicyForResponseSync(m_frame->frameID(), SecurityOriginData::fromFrame(coreFrame), response, request, canShowMIMEType, listenerID, UserData(WebProcess::singleton().transformObjectsToHandles(userData.get()).get())), Messages::WebPageProxy::DecidePolicyForResponseSync::Reply(receivedPolicyAction, policyAction, downloadID), std::chrono::milliseconds::max(), IPC::InformPlatformProcessWillSuspend)) {
m_frame->didReceivePolicyDecision(listenerID, PolicyIgnore, 0, { });
return;
@@ -821,6 +822,7 @@
documentLoader = static_cast<WebDocumentLoader*>(coreFrame->loader().documentLoader());
// Notify the UIProcess.
+ Ref<WebFrame> protect(*m_frame);
WebCore::Frame* originatingCoreFrame = originatingFrame ? originatingFrame->coreFrame() : nullptr;
if (!webPage->sendSync(Messages::WebPageProxy::DecidePolicyForNavigationAction(m_frame->frameID(), SecurityOriginData::fromFrame(coreFrame), documentLoader->navigationID(), navigationActionData, originatingFrame ? originatingFrame->frameID() : 0, SecurityOriginData::fromFrame(originatingCoreFrame), navigationAction.resourceRequest(), request, listenerID, UserData(WebProcess::singleton().transformObjectsToHandles(userData.get()).get())), Messages::WebPageProxy::DecidePolicyForNavigationAction::Reply(receivedPolicyAction, newNavigationID, policyAction, downloadID))) {
m_frame->didReceivePolicyDecision(listenerID, PolicyIgnore, 0, { });
