[Webkit-unassigned] [Bug 24636] New: Fix crash of Chromium port in use of BackForwardList in SVG images

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=24636

           Summary: Fix crash of Chromium port in use of BackForwardList in
                    SVG images
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Windows XP
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: Platform
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: hclam at google.com


Crash filed against Chromium:
http://code.google.com/p/chromium/issues/detail?id=6869

When a SVG image is created, a WebCore::Page is created with BackForwardList
but
BackForwardList::m_client is never initialized. During eviction of the cached
SVG image, m_client->close() is called in BackForwardList::close() resulting in
a crash. Since the WebCore::Page in SVGImage doesn't have links to the frame,
there's no BackForwardListClient implementation available, so we just don't
care these requests to BackForwardList and don't delegate the requests when
m_client is NULL.


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.