Title: [241500] trunk
Revision
241500
Author
[email protected]
Date
2019-02-13 22:47:32 -0800 (Wed, 13 Feb 2019)

Log Message

Crash in WKBundleFrameGetParentFrame when called inside didRemoveFrameFromHierarchy
https://bugs.webkit.org/show_bug.cgi?id=194641

Reviewed by Geoffrey Garen.

Source/WebKit:

Fixed the bug by adding a null check to WebFrame::parentFrame.

* WebProcess/WebPage/WebFrame.cpp:
(WebKit::WebFrame::parentFrame const):

Tools:

Added a call to WKBundleFrameGetParentFrame to an existing test for didRemoveFrameFromHierarchy
so that the test would fail without this fix.

* TestWebKitAPI/Tests/WebKit/DidRemoveFrameFromHiearchyInPageCache_Bundle.cpp:
(TestWebKitAPI::didRemoveFrameFromHierarchyCallback):

Modified Paths

Diff

Modified: trunk/Source/WebKit/ChangeLog (241499 => 241500)


--- trunk/Source/WebKit/ChangeLog	2019-02-14 06:43:13 UTC (rev 241499)
+++ trunk/Source/WebKit/ChangeLog	2019-02-14 06:47:32 UTC (rev 241500)
@@ -1,3 +1,15 @@
+2019-02-13  Ryosuke Niwa  <[email protected]>
+
+        Crash in WKBundleFrameGetParentFrame when called inside didRemoveFrameFromHierarchy
+        https://bugs.webkit.org/show_bug.cgi?id=194641
+
+        Reviewed by Geoffrey Garen.
+
+        Fixed the bug by adding a null check to WebFrame::parentFrame.
+
+        * WebProcess/WebPage/WebFrame.cpp:
+        (WebKit::WebFrame::parentFrame const):
+
 2019-02-13  Timothy Hatcher  <[email protected]>
 
         Allow some deprecations in WKDrawingView.

Modified: trunk/Source/WebKit/WebProcess/WebPage/WebFrame.cpp (241499 => 241500)


--- trunk/Source/WebKit/WebProcess/WebPage/WebFrame.cpp	2019-02-14 06:43:13 UTC (rev 241499)
+++ trunk/Source/WebKit/WebProcess/WebPage/WebFrame.cpp	2019-02-14 06:47:32 UTC (rev 241500)
@@ -463,9 +463,13 @@
 WebFrame* WebFrame::parentFrame() const
 {
     if (!m_coreFrame || !m_coreFrame->ownerElement())
-        return 0;
+        return nullptr;
 
-    return WebFrame::fromCoreFrame(*m_coreFrame->ownerElement()->document().frame());
+    auto* frame = m_coreFrame->ownerElement()->document().frame();
+    if (!frame)
+        return nullptr;
+
+    return WebFrame::fromCoreFrame(*frame);
 }
 
 Ref<API::Array> WebFrame::childFrames()

Modified: trunk/Tools/ChangeLog (241499 => 241500)


--- trunk/Tools/ChangeLog	2019-02-14 06:43:13 UTC (rev 241499)
+++ trunk/Tools/ChangeLog	2019-02-14 06:47:32 UTC (rev 241500)
@@ -1,3 +1,16 @@
+2019-02-13  Ryosuke Niwa  <[email protected]>
+
+        Crash in WKBundleFrameGetParentFrame when called inside didRemoveFrameFromHierarchy
+        https://bugs.webkit.org/show_bug.cgi?id=194641
+
+        Reviewed by Geoffrey Garen.
+
+        Added a call to WKBundleFrameGetParentFrame to an existing test for didRemoveFrameFromHierarchy
+        so that the test would fail without this fix.
+
+        * TestWebKitAPI/Tests/WebKit/DidRemoveFrameFromHiearchyInPageCache_Bundle.cpp:
+        (TestWebKitAPI::didRemoveFrameFromHierarchyCallback):
+
 2019-02-13  Aakash Jain  <[email protected]>
 
         [ews-app] Change log level for a log statement

Modified: trunk/Tools/TestWebKitAPI/Tests/WebKit/DidRemoveFrameFromHiearchyInPageCache_Bundle.cpp (241499 => 241500)


--- trunk/Tools/TestWebKitAPI/Tests/WebKit/DidRemoveFrameFromHiearchyInPageCache_Bundle.cpp	2019-02-14 06:43:13 UTC (rev 241499)
+++ trunk/Tools/TestWebKitAPI/Tests/WebKit/DidRemoveFrameFromHiearchyInPageCache_Bundle.cpp	2019-02-14 06:47:32 UTC (rev 241500)
@@ -30,6 +30,7 @@
 #include "InjectedBundleTest.h"
 
 #include "PlatformUtilities.h"
+#include <WebKit/WKBundleFrame.h>
 #include <WebKit/WKBundlePage.h>
 
 namespace TestWebKitAPI {
@@ -45,10 +46,12 @@
 
 static unsigned didRemoveFrameFromHierarchyCount;
 
-void didRemoveFrameFromHierarchyCallback(WKBundlePageRef page, WKBundleFrameRef, WKTypeRef*, const void*)
+void didRemoveFrameFromHierarchyCallback(WKBundlePageRef page, WKBundleFrameRef frame, WKTypeRef*, const void*)
 {
     didRemoveFrameFromHierarchyCount++;
 
+    RELEASE_ASSERT(!WKBundleFrameGetParentFrame(frame));
+
     WKRetainPtr<WKStringRef> message(AdoptWK, WKStringCreateWithUTF8CString("DidRemoveFrameFromHierarchy"));
     WKBundlePagePostMessage(page, message.get(), message.get());
 }
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to