From d77c2d75edc3cb9b331e76934c7a8ce7a57afc41 Mon Sep 17 00:00:00 2001 From: "trop[bot]" <37223003+trop[bot]@users.noreply.github.com> Date: Thu, 23 Jan 2025 11:53:40 +0100 Subject: [PATCH] fix: potential crash in `chrome.tabs.update()` (#45302) fix: potential crash in chrome.tabs.update() Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com> Co-authored-by: Shelley Vohr --- shell/browser/extensions/api/tabs/tabs_api.cc | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/shell/browser/extensions/api/tabs/tabs_api.cc b/shell/browser/extensions/api/tabs/tabs_api.cc index aa57c2c8c6ea..c1962e0b0d98 100644 --- a/shell/browser/extensions/api/tabs/tabs_api.cc +++ b/shell/browser/extensions/api/tabs/tabs_api.cc @@ -651,7 +651,16 @@ bool TabsUpdateFunction::UpdateURL(const std::string& url_string, // will stay in the omnibox - see https://crbug.com/1085779. load_params.transition_type = ui::PAGE_TRANSITION_FROM_API; - web_contents_->GetController().LoadURLWithParams(load_params); + base::WeakPtr navigation_handle = + web_contents_->GetController().LoadURLWithParams(load_params); + // Navigation can fail for any number of reasons at the content layer. + // Unfortunately, we can't provide a detailed error message here, because + // there are too many possible triggers. At least notify the extension that + // the update failed. + if (!navigation_handle) { + *error = "Navigation rejected."; + return false; + } DCHECK_EQ(url, web_contents_->GetController().GetPendingEntry()->GetVirtualURL());