[Webkit-unassigned] [Bug 25243] Crash when data:// loads are cancelled

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=25243





------- Comment #3 from gns at gnome.org  2009-04-20 07:23 PDT -------
(In reply to comment #2)
> So, all the checks are needed for the crash to go away, or you are just being
> extra careful? And the FrameLoaderClientGtk change is for the same bug?

No, I think we can get along (for this specific crash) with only this check:

         if (data.length() > 0)
             client->didReceiveData(handle, reinterpret_cast<const
char*>(data.c
+
+        if (d->m_cancelled)
+            return false;

The other checks I am adding are based on previous experience with fixing
loading crashers. We should never trust a load (and the objects that are bound
to it) to still exist after dispatching delegates, such as didReceiveResponse.
As with content sniffing, plugins add yet another layer of potential problems,
because they also delay the didReceiveResponse to when they get the first data
(that's why we have that check in FrameLoaderClient, and this one after
didReceiveData).

Since the checks are all fixing the same problem, though happening under
different conditions, I think they make sense as a single commit.


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.