Title: [243738] trunk/Source/WebCore
- Revision
- 243738
- Author
- [email protected]
- Date
- 2019-04-01 23:44:45 -0700 (Mon, 01 Apr 2019)
Log Message
Nullptr crash in Document::open after calling policyChecker().stopCheck()
https://bugs.webkit.org/show_bug.cgi?id=196479
Reviewed by Antti Koivisto.
Added a missing nullptr check in Document::open after calling m_frame->loader().policyChecker().stopCheck()
since it invokes m_willSubmitFormCompletionHandlers in WebKit2, and that could clear m_frame.
Unfortunately, we don't have any reproducible test case.
* dom/Document.cpp:
(WebCore::Document::open):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (243737 => 243738)
--- trunk/Source/WebCore/ChangeLog 2019-04-02 06:23:42 UTC (rev 243737)
+++ trunk/Source/WebCore/ChangeLog 2019-04-02 06:44:45 UTC (rev 243738)
@@ -1,3 +1,18 @@
+2019-04-01 Ryosuke Niwa <[email protected]>
+
+ Nullptr crash in Document::open after calling policyChecker().stopCheck()
+ https://bugs.webkit.org/show_bug.cgi?id=196479
+
+ Reviewed by Antti Koivisto.
+
+ Added a missing nullptr check in Document::open after calling m_frame->loader().policyChecker().stopCheck()
+ since it invokes m_willSubmitFormCompletionHandlers in WebKit2, and that could clear m_frame.
+
+ Unfortunately, we don't have any reproducible test case.
+
+ * dom/Document.cpp:
+ (WebCore::Document::open):
+
2019-04-01 Timothy Hatcher <[email protected]>
Unreviewed build fix.
Modified: trunk/Source/WebCore/dom/Document.cpp (243737 => 243738)
--- trunk/Source/WebCore/dom/Document.cpp 2019-04-02 06:23:42 UTC (rev 243737)
+++ trunk/Source/WebCore/dom/Document.cpp 2019-04-02 06:44:45 UTC (rev 243738)
@@ -2738,7 +2738,7 @@
if (m_frame->loader().policyChecker().delegateIsDecidingNavigationPolicy())
m_frame->loader().policyChecker().stopCheck();
- if (m_frame->loader().state() == FrameStateProvisional)
+ if (m_frame && m_frame->loader().state() == FrameStateProvisional)
m_frame->loader().stopAllLoaders();
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
