Title: [245923] branches/safari-607-branch/Source/WebCore
- Revision
- 245923
- Author
- [email protected]
- Date
- 2019-05-30 17:30:07 -0700 (Thu, 30 May 2019)
Log Message
Cherry-pick r245464. rdar://problem/51264866
Hardening: Prevent FrameLoader crash due to SetForScope
https://bugs.webkit.org/show_bug.cgi?id=197458
<rdar://problem/50368338>
Reviewed by Chris Dumez.
Since SetForScope takes action during a function returns, it might cause
a crash if its scope is broader than the value it is resetting.
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::loadDifferentDocumentItem):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245464 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Diff
Modified: branches/safari-607-branch/Source/WebCore/ChangeLog (245922 => 245923)
--- branches/safari-607-branch/Source/WebCore/ChangeLog 2019-05-31 00:30:04 UTC (rev 245922)
+++ branches/safari-607-branch/Source/WebCore/ChangeLog 2019-05-31 00:30:07 UTC (rev 245923)
@@ -1,5 +1,37 @@
2019-05-30 Kocsen Chung <[email protected]>
+ Cherry-pick r245464. rdar://problem/51264866
+
+ Hardening: Prevent FrameLoader crash due to SetForScope
+ https://bugs.webkit.org/show_bug.cgi?id=197458
+ <rdar://problem/50368338>
+
+ Reviewed by Chris Dumez.
+
+ Since SetForScope takes action during a function returns, it might cause
+ a crash if its scope is broader than the value it is resetting.
+
+ * loader/FrameLoader.cpp:
+ (WebCore::FrameLoader::loadDifferentDocumentItem):
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245464 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-05-17 Brent Fulgham <[email protected]>
+
+ Hardening: Prevent FrameLoader crash due to SetForScope
+ https://bugs.webkit.org/show_bug.cgi?id=197458
+ <rdar://problem/50368338>
+
+ Reviewed by Chris Dumez.
+
+ Since SetForScope takes action during a function returns, it might cause
+ a crash if its scope is broader than the value it is resetting.
+
+ * loader/FrameLoader.cpp:
+ (WebCore::FrameLoader::loadDifferentDocumentItem):
+
+2019-05-30 Kocsen Chung <[email protected]>
+
Cherry-pick r245361. rdar://problem/51264842
Do not create a shape object outside of the layout context
Modified: branches/safari-607-branch/Source/WebCore/loader/FrameLoader.cpp (245922 => 245923)
--- branches/safari-607-branch/Source/WebCore/loader/FrameLoader.cpp 2019-05-31 00:30:04 UTC (rev 245922)
+++ branches/safari-607-branch/Source/WebCore/loader/FrameLoader.cpp 2019-05-31 00:30:07 UTC (rev 245923)
@@ -3666,6 +3666,8 @@
{
RELEASE_LOG_IF_ALLOWED("loadDifferentDocumentItem: frame load started (frame = %p, main = %d)", &m_frame, m_frame.isMainFrame());
+ Ref<Frame> protectedFrame(m_frame);
+
// History items should not be reported to the parent.
m_shouldReportResourceTimingToParentFrame = false;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
