2010-06-17 Abhishek Arya <inferno@chromium.org>

        Reviewed by David Kilzer.

        (Landed by Dirk Pranke).

        Check for a null frame before setting drag selection.
        https://bugs.webkit.org/show_bug.cgi?id=38893
        Same Layout test as https://bugs.webkit.org/show_bug.cgi?id=37168.

        Test: editing/pasteboard/drag-drop-iframe-refresh-crash.html

        Note that you need to run the test manually 20-30 times for the crash
        to reproduce.

        * editing/SelectionController.cpp:
        (WebCore::SelectionController::setSelection):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@61365 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index b08aead6b7f39f90f7050dc2e47ab8aa5fb16459..86db8b93fbbb7df37858de7342e477a6a786496c 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,21 @@
+2010-06-17  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by David Kilzer.
+
+        (Landed by Dirk Pranke).
+
+        Check for a null frame before setting drag selection.
+        https://bugs.webkit.org/show_bug.cgi?id=38893
+        Same Layout test as https://bugs.webkit.org/show_bug.cgi?id=37168.
+
+        Test: editing/pasteboard/drag-drop-iframe-refresh-crash.html  
+
+        Note that you need to run the test manually 20-30 times for the crash
+        to reproduce.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelection):
+
 2010-06-17  Benjamin Poulain  <benjamin.poulain@nokia.com>
 
         Reviewed by Simon Hausmann.

diff --git a/WebCore/editing/SelectionController.cpp b/WebCore/editing/SelectionController.cpp
index ca18bc1b3dd45de34c7006e05dd1b7719a6058df..b17ab10117616e8719f1e86d562ceeb25f4eb49b 100644 (file)
--- a/WebCore/editing/SelectionController.cpp
+++ b/WebCore/editing/SelectionController.cpp
@@ -131,7 +131,7 @@ void SelectionController::setSelection(const VisibleSelection& s, bool closeTypi
     
     // <http://bugs.webkit.org/show_bug.cgi?id=23464>: Infinite recursion at SelectionController::setSelection
     // if document->frame() == m_frame we can get into an infinite loop
-    if (document && document->frame() != m_frame && document != m_frame->document()) {
+    if (document && document->frame() && document->frame() != m_frame && document != m_frame->document()) {
         document->frame()->selection()->setSelection(s, closeTyping, clearTypingStyle, userTriggered);
         return;
     }