Title: [201565] trunk/Source/WebCore
- Revision
- 201565
- Author
- [email protected]
- Date
- 2016-06-01 13:15:23 -0700 (Wed, 01 Jun 2016)
Log Message
Fix null dereferencing in ResourceTimingInformation::addResourceTiming
https://bugs.webkit.org/show_bug.cgi?id=158266
rdar://problem/26528466
Patch by Alex Christensen <[email protected]> on 2016-06-01
Reviewed by Chris Dumez.
This would crash sometimes in http/tests/security/cross-frame-access-custom.html
* loader/ResourceTimingInformation.cpp:
(WebCore::ResourceTimingInformation::addResourceTiming):
* loader/ResourceTimingInformation.h:
* loader/cache/CachedResourceLoader.cpp:
(WebCore::CachedResourceLoader::requestResource):
(WebCore::CachedResourceLoader::loadDone):
We would dereference a null pointer on the first instruction when calling
Document::parentDocument from ResourceTimingInformation::addResourceTiming,
which means the document was null. CachedResourceLoader::document even has
a comment saying it can be null, so we should check it before using it.
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (201564 => 201565)
--- trunk/Source/WebCore/ChangeLog 2016-06-01 19:55:38 UTC (rev 201564)
+++ trunk/Source/WebCore/ChangeLog 2016-06-01 20:15:23 UTC (rev 201565)
@@ -1,3 +1,24 @@
+2016-06-01 Alex Christensen <[email protected]>
+
+ Fix null dereferencing in ResourceTimingInformation::addResourceTiming
+ https://bugs.webkit.org/show_bug.cgi?id=158266
+ rdar://problem/26528466
+
+ Reviewed by Chris Dumez.
+
+ This would crash sometimes in http/tests/security/cross-frame-access-custom.html
+
+ * loader/ResourceTimingInformation.cpp:
+ (WebCore::ResourceTimingInformation::addResourceTiming):
+ * loader/ResourceTimingInformation.h:
+ * loader/cache/CachedResourceLoader.cpp:
+ (WebCore::CachedResourceLoader::requestResource):
+ (WebCore::CachedResourceLoader::loadDone):
+ We would dereference a null pointer on the first instruction when calling
+ Document::parentDocument from ResourceTimingInformation::addResourceTiming,
+ which means the document was null. CachedResourceLoader::document even has
+ a comment saying it can be null, so we should check it before using it.
+
2016-06-01 Said Abou-Hallawa <[email protected]>
SVGImage should report its memory cost to JS garbage collector
Modified: trunk/Source/WebCore/loader/ResourceTimingInformation.cpp (201564 => 201565)
--- trunk/Source/WebCore/loader/ResourceTimingInformation.cpp 2016-06-01 19:55:38 UTC (rev 201564)
+++ trunk/Source/WebCore/loader/ResourceTimingInformation.cpp 2016-06-01 20:15:23 UTC (rev 201565)
@@ -38,17 +38,16 @@
namespace WebCore {
-void ResourceTimingInformation::addResourceTiming(CachedResource* resource, Document* document)
+void ResourceTimingInformation::addResourceTiming(CachedResource* resource, Document& document)
{
ASSERT(RuntimeEnabledFeatures::sharedFeatures().resourceTimingEnabled());
if (resource && resource->resourceRequest().url().protocolIsInHTTPFamily()
&& ((!resource->errorOccurred() && !resource->wasCanceled()) || resource->response().httpStatusCode() == 304)) {
- HashMap<CachedResource*, InitiatorInfo>::iterator initiatorIt = m_initiatorMap.find(resource);
+ auto initiatorIt = m_initiatorMap.find(resource);
if (initiatorIt != m_initiatorMap.end() && initiatorIt->value.added == NotYetAdded) {
- ASSERT(document);
- Document* initiatorDocument = document;
+ Document* initiatorDocument = &document;
if (resource->type() == CachedResource::MainResource)
- initiatorDocument = document->parentDocument();
+ initiatorDocument = document.parentDocument();
ASSERT(initiatorDocument);
ASSERT(initiatorDocument->domWindow());
ASSERT(initiatorDocument->domWindow()->performance());
Modified: trunk/Source/WebCore/loader/ResourceTimingInformation.h (201564 => 201565)
--- trunk/Source/WebCore/loader/ResourceTimingInformation.h 2016-06-01 19:55:38 UTC (rev 201564)
+++ trunk/Source/WebCore/loader/ResourceTimingInformation.h 2016-06-01 20:15:23 UTC (rev 201565)
@@ -41,7 +41,7 @@
class ResourceTimingInformation {
public:
- void addResourceTiming(CachedResource*, Document*);
+ void addResourceTiming(CachedResource*, Document&);
void storeResourceTimingInitiatorInformation(const CachedResourceHandle<CachedResource>&, const CachedResourceRequest&, Frame*);
private:
Modified: trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp (201564 => 201565)
--- trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp 2016-06-01 19:55:38 UTC (rev 201564)
+++ trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp 2016-06-01 20:15:23 UTC (rev 201565)
@@ -619,9 +619,9 @@
logMemoryCacheResourceRequest(frame(), DiagnosticLoggingKeys::inMemoryCacheKey(), DiagnosticLoggingKeys::usedKey());
memoryCache.resourceAccessed(*resource);
#if ENABLE(WEB_TIMING)
- if (RuntimeEnabledFeatures::sharedFeatures().resourceTimingEnabled()) {
+ if (document() && RuntimeEnabledFeatures::sharedFeatures().resourceTimingEnabled()) {
m_resourceTimingInfo.storeResourceTimingInitiatorInformation(resource, request, frame());
- m_resourceTimingInfo.addResourceTiming(resource.get(), document());
+ m_resourceTimingInfo.addResourceTiming(resource.get(), *document());
}
#endif
break;
@@ -967,8 +967,8 @@
RefPtr<Document> protectDocument(m_document);
#if ENABLE(WEB_TIMING)
- if (RuntimeEnabledFeatures::sharedFeatures().resourceTimingEnabled())
- m_resourceTimingInfo.addResourceTiming(resource, document());
+ if (document() && RuntimeEnabledFeatures::sharedFeatures().resourceTimingEnabled())
+ m_resourceTimingInfo.addResourceTiming(resource, *document());
#else
UNUSED_PARAM(resource);
#endif
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
