From 5aabb6bec5eed5775e106ae2c4b093b986d63ca4 Mon Sep 17 00:00:00 2001 From: Shelley Vohr Date: Wed, 22 Jan 2025 17:02:29 +0100 Subject: [PATCH] fix: potential crash in `chrome.tabs.update()` (#45276) fix: potential crash in chrome.tabs.update() --- shell/browser/extensions/api/tabs/tabs_api.cc | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/shell/browser/extensions/api/tabs/tabs_api.cc b/shell/browser/extensions/api/tabs/tabs_api.cc index aa57c2c8c6ea..c1962e0b0d98 100644 --- a/shell/browser/extensions/api/tabs/tabs_api.cc +++ b/shell/browser/extensions/api/tabs/tabs_api.cc @@ -651,7 +651,16 @@ bool TabsUpdateFunction::UpdateURL(const std::string& url_string, // will stay in the omnibox - see https://crbug.com/1085779. load_params.transition_type = ui::PAGE_TRANSITION_FROM_API; - web_contents_->GetController().LoadURLWithParams(load_params); + base::WeakPtr navigation_handle = + web_contents_->GetController().LoadURLWithParams(load_params); + // Navigation can fail for any number of reasons at the content layer. + // Unfortunately, we can't provide a detailed error message here, because + // there are too many possible triggers. At least notify the extension that + // the update failed. + if (!navigation_handle) { + *error = "Navigation rejected."; + return false; + } DCHECK_EQ(url, web_contents_->GetController().GetPendingEntry()->GetVirtualURL());