[webkit-reviews] review granted: [Bug 61494] REGRESSION (r78342) - Crashes when Document calls into a freed DocumentLoader : [Attachment 95213] Patch v2 - With Darin's review feedback

[bugzilla-daemon at webkit.org]

Darin Adler <darin at apple.com> has granted Brady Eidson <beidson at apple.com>'s
request for review:
Bug 61494: REGRESSION (r78342) - Crashes when Document calls into a freed
DocumentLoader
https://bugs.webkit.org/show_bug.cgi?id=61494

Attachment 95213: Patch v2 - With Darin's review feedback
https://bugs.webkit.org/attachment.cgi?id=95213&action=review

------- Additional Comments from Darin Adler <darin at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=95213&action=review

> Source/WebCore/dom/Document.cpp:4522
> +	   DocumentLoader* documentLoader = loader();
> +	   // Since we're still in a Frame, we should have a DocumentLoader.
> +	   ASSERT(documentLoader);
> +	   if (documentLoader->substituteData().isValid())

There’s no check of documentLoader being null here. I know you meant to add
one.

> Source/WebCore/dom/Document.cpp:4605
> +    // Since we're still in a frame, we should have a DocumentLoader.
> +    ASSERT(loader());
> +    loader()->replaceRequestURLForSameDocumentNavigation(url);

Why was this the one place we decided not to add a null check?