95171 kov diff --git a/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/WebCore/platform/network/soup/ResourceHandleSoup.cpp index 205c68f..4c59d34 100644 --- a/WebCore/platform/network/soup/ResourceHandleSoup.cpp +++ b/WebCore/platform/network/soup/ResourceHandleSoup.cpp @@ -388,6 +388,9 @@ static gboolean parseDataUrl(gpointer callback_data) response.setTextEncodingName(charset); client->didReceiveResponse(handle, response); + // The load may be cancelled, and the client may be destroyed + // by any of the client reporting calls, so we check, and bail + // out in either of those cases. if (!handle->client() || d->m_cancelled) return false; 3475487062 #webkit-gtk WebKit (text or diff) TRUE 1 kov diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog index a296aec..9304910 100644 --- a/WebCore/ChangeLog +++ b/WebCore/ChangeLog @@ -5,6 +5,14 @@ fast/frames/iframe-reparenting.html crashing on GTK Debug bots https://bugs.webkit.org/show_bug.cgi?id=35081 + Check that the client is alive after every call to it, since any + of them could cause the load to be cancelled, and the client to go + away. + + This is much better than protecting a specific subclass of + ResourceHandleClient (ResourceLoader), which makes us fail when + any other client is used. + Test: fast/frames/iframe-reparenting.html * platform/network/soup/ResourceHandleSoup.cpp: diff --git a/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/WebCore/platform/network/soup/ResourceHandleSoup.cpp index 205c68f..4c59d34 100644 --- a/WebCore/platform/network/soup/ResourceHandleSoup.cpp +++ b/WebCore/platform/network/soup/ResourceHandleSoup.cpp @@ -388,6 +388,9 @@ static gboolean parseDataUrl(gpointer callback_data) response.setTextEncodingName(charset); client->didReceiveResponse(handle, response); + // The load may be cancelled, and the client may be destroyed + // by any of the client reporting calls, so we check, and bail + // out in either of those cases. if (!handle->client() || d->m_cancelled) return false; 3475487261 #webkit-gtk TRUE