[Webkit-unassigned] [Bug 29910] New: Load state can get out of sync in a client callback, leading to a crash.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=29910

           Summary: Load state can get out of sync in a client callback,
                    leading to a crash.
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Page Loading
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: yael.aharon at nokia.com


In my specific use case, an attempt is made to load a non-existing page from
the local file system.
When the provisional load is cleared, the provisional loader is cleared before
the progress callback, but the state is cleared after the progress callback.
A client could e.g. try to set a user stylesheet from inside the progress
callback, which will result in a crash - the state is still
FrameStateProvisional, but the provisional loader is NULL.

Clearing both states before calling the progress callback eliminates the crash.

I would love to add a new test case for this, but since this is a complex use
case, I am not sure how.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.