<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Nullptr dereferences when stopping a load"
href="https://bugs.webkit.org/show_bug.cgi?id=168608">168608</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Nullptr dereferences when stopping a load
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>WebKit Nightly Build
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>OS</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>Page Loading
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>bfulgham@webkit.org
</td>
</tr>
<tr>
<th>CC</th>
<td>beidson@apple.com
</td>
</tr></table>
<p>
<div>
<pre>We have seen crash traces that indicate the frame is being detached from the document while stopping a load, leading to nullptr dereferences and crashes.
Other loading code anticipates the possibility the the frame is nullptr. Since these crashes are happening at the tail end of the load termination, when attempting to notify the now-detached client that the load was stopped, we should probably just recognize this is happening and avoid the dereference.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>