Real fix for <rdar://problem/9025723> CrashTracer: [USER]

1 crash in WebProcess at com.apple.WebKit2:
WebKit::WebPage::didChangeScrollOffsetForMainFrame + 31

Reviewed by Adele Peterson.

* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
(WebKit::WebFrameLoaderClient::didChangeScrollOffset):
Add null check for the FrameView. This function can be called when the
FrameView is being torn down during a transition to a new FrameView.

* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::didChangeScrollOffsetForMainFrame):
Revert last attempt.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@79064 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
index 798e145165b14a66cdeadf7d441cdf5e0930c997..c9160bfc533e842475908ef9ecb1b58c1ca67066 100644 (file)
--- a/Source/WebKit2/ChangeLog
+++ b/Source/WebKit2/ChangeLog
@@ -1,3 +1,20 @@
+2011-02-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Real fix for <rdar://problem/9025723> CrashTracer: [USER] 
+        1 crash in WebProcess at com.apple.WebKit2: 
+        WebKit::WebPage::didChangeScrollOffsetForMainFrame + 31
+
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit::WebFrameLoaderClient::didChangeScrollOffset):
+        Add null check for the FrameView. This function can be called when the
+        FrameView is being torn down during a transition to a new FrameView.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::didChangeScrollOffsetForMainFrame):
+        Revert last attempt.
+
 2011-02-18  Anders Carlsson  <andersca@apple.com>
 
         Reviewed by Sam Weinig.

diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
index 64fe8b220df6e1665034bfa0053adb8f32cd4d39..470faef7052b7d32287850f827e22e6e92e5f55c 100644 (file)
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
@@ -1302,6 +1302,11 @@ void WebFrameLoaderClient::didChangeScrollOffset()
     if (!m_frame->isMainFrame())
         return;
 
+    // If this is called when tearing down a FrameView, the WebCore::Frame's
+    // current FrameView will be null.
+    if (!m_frame->coreFrame()->view())
+        return;
+
     webPage->didChangeScrollOffsetForMainFrame();
 }
 

diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
index 621207b3b4d686f34781b45571917bab7973f6e4..ff5399c6c4171a4d48d0c693faa58aad69f480bd 100644 (file)
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
@@ -1685,9 +1685,6 @@ bool WebPage::mainFrameHasCustomRepresentation() const
 void WebPage::didChangeScrollOffsetForMainFrame()
 {
     Frame* frame = m_page->mainFrame();
-    if (!frame)
-        return;
-
     IntPoint scrollPosition = frame->view()->scrollPosition();
     IntPoint maximumScrollPosition = frame->view()->maximumScrollPosition();