Title: [249239] branches/safari-608-branch
- Revision
- 249239
- Author
- [email protected]
- Date
- 2019-08-28 22:57:12 -0700 (Wed, 28 Aug 2019)
Log Message
Cherry-pick r249156. rdar://problem/54775048
Crash under WebCore::jsNotificationConstructorPermission
https://bugs.webkit.org/show_bug.cgi?id=201186
<rdar://problem/53962833>
Reviewed by Youenn Fablet.
Source/WebCore:
Update the Notification API implementation to null-check the page before using. The page becomes null
when using the API in a frame that gets detached from its parent while in the middle of running
script.
Test: http/tests/notifications/request-in-detached-frame.html
* Modules/notifications/Notification.cpp:
(WebCore::Notification::permission):
(WebCore::Notification::requestPermission):
LayoutTests:
Add layout test coverage.
* http/tests/notifications/request-in-detached-frame-expected.txt: Added.
* http/tests/notifications/request-in-detached-frame.html: Added.
* http/tests/notifications/resources/request-in-detached-frame-subframe.html: Added.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@249156 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Modified: branches/safari-608-branch/LayoutTests/ChangeLog (249238 => 249239)
--- branches/safari-608-branch/LayoutTests/ChangeLog 2019-08-29 05:57:06 UTC (rev 249238)
+++ branches/safari-608-branch/LayoutTests/ChangeLog 2019-08-29 05:57:12 UTC (rev 249239)
@@ -1,3 +1,49 @@
+2019-08-28 Kocsen Chung <[email protected]>
+
+ Cherry-pick r249156. rdar://problem/54775048
+
+ Crash under WebCore::jsNotificationConstructorPermission
+ https://bugs.webkit.org/show_bug.cgi?id=201186
+ <rdar://problem/53962833>
+
+ Reviewed by Youenn Fablet.
+
+ Source/WebCore:
+
+ Update the Notification API implementation to null-check the page before using. The page becomes null
+ when using the API in a frame that gets detached from its parent while in the middle of running
+ script.
+
+ Test: http/tests/notifications/request-in-detached-frame.html
+
+ * Modules/notifications/Notification.cpp:
+ (WebCore::Notification::permission):
+ (WebCore::Notification::requestPermission):
+
+ LayoutTests:
+
+ Add layout test coverage.
+
+ * http/tests/notifications/request-in-detached-frame-expected.txt: Added.
+ * http/tests/notifications/request-in-detached-frame.html: Added.
+ * http/tests/notifications/resources/request-in-detached-frame-subframe.html: Added.
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@249156 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-08-27 Chris Dumez <[email protected]>
+
+ Crash under WebCore::jsNotificationConstructorPermission
+ https://bugs.webkit.org/show_bug.cgi?id=201186
+ <rdar://problem/53962833>
+
+ Reviewed by Youenn Fablet.
+
+ Add layout test coverage.
+
+ * http/tests/notifications/request-in-detached-frame-expected.txt: Added.
+ * http/tests/notifications/request-in-detached-frame.html: Added.
+ * http/tests/notifications/resources/request-in-detached-frame-subframe.html: Added.
+
2019-08-27 Ryan Haddad <[email protected]>
Revert r249166. rdar://problem/53829560
Added: branches/safari-608-branch/LayoutTests/http/tests/notifications/request-in-detached-frame-expected.txt (0 => 249239)
--- branches/safari-608-branch/LayoutTests/http/tests/notifications/request-in-detached-frame-expected.txt (rev 0)
+++ branches/safari-608-branch/LayoutTests/http/tests/notifications/request-in-detached-frame-expected.txt 2019-08-29 05:57:12 UTC (rev 249239)
@@ -0,0 +1,10 @@
+This test checks accessing Notification.permission in a detached iframe.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS Notification.permission is "default"
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: branches/safari-608-branch/LayoutTests/http/tests/notifications/request-in-detached-frame.html (0 => 249239)
--- branches/safari-608-branch/LayoutTests/http/tests/notifications/request-in-detached-frame.html (rev 0)
+++ branches/safari-608-branch/LayoutTests/http/tests/notifications/request-in-detached-frame.html 2019-08-29 05:57:12 UTC (rev 249239)
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<script src=""
+<script src=""
+<p id="description"></p>
+<div id="console"></div>
+<iframe id="testFrame" src=""
+<script>
+description("This test checks accessing Notification.permission in a detached iframe.");
+
+if (window.testRunner)
+ testRunner.waitUntilDone();
+
+_onload_ = () => {
+ testFrame.contentWindow.postMessage("foo", "*");
+ setTimeout(() => {
+ testCompleted();
+ }, 100);
+};
+</script>
Added: branches/safari-608-branch/LayoutTests/http/tests/notifications/resources/request-in-detached-frame-subframe.html (0 => 249239)
--- branches/safari-608-branch/LayoutTests/http/tests/notifications/resources/request-in-detached-frame-subframe.html (rev 0)
+++ branches/safari-608-branch/LayoutTests/http/tests/notifications/resources/request-in-detached-frame-subframe.html 2019-08-29 05:57:12 UTC (rev 249239)
@@ -0,0 +1,10 @@
+<script>
+_onmessage_ = function(msg) {
+ let p = parent;
+ p.testFrame.remove();
+ p.shouldBeEqualToString("Notification.permission", "default");
+ Notification.requestPermission((result) => {
+ p.testFailed("Permission handler should not have been called");
+ });
+}
+</script>
Modified: branches/safari-608-branch/Source/WebCore/ChangeLog (249238 => 249239)
--- branches/safari-608-branch/Source/WebCore/ChangeLog 2019-08-29 05:57:06 UTC (rev 249238)
+++ branches/safari-608-branch/Source/WebCore/ChangeLog 2019-08-29 05:57:12 UTC (rev 249239)
@@ -1,5 +1,55 @@
2019-08-28 Kocsen Chung <[email protected]>
+ Cherry-pick r249156. rdar://problem/54775048
+
+ Crash under WebCore::jsNotificationConstructorPermission
+ https://bugs.webkit.org/show_bug.cgi?id=201186
+ <rdar://problem/53962833>
+
+ Reviewed by Youenn Fablet.
+
+ Source/WebCore:
+
+ Update the Notification API implementation to null-check the page before using. The page becomes null
+ when using the API in a frame that gets detached from its parent while in the middle of running
+ script.
+
+ Test: http/tests/notifications/request-in-detached-frame.html
+
+ * Modules/notifications/Notification.cpp:
+ (WebCore::Notification::permission):
+ (WebCore::Notification::requestPermission):
+
+ LayoutTests:
+
+ Add layout test coverage.
+
+ * http/tests/notifications/request-in-detached-frame-expected.txt: Added.
+ * http/tests/notifications/request-in-detached-frame.html: Added.
+ * http/tests/notifications/resources/request-in-detached-frame-subframe.html: Added.
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@249156 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-08-27 Chris Dumez <[email protected]>
+
+ Crash under WebCore::jsNotificationConstructorPermission
+ https://bugs.webkit.org/show_bug.cgi?id=201186
+ <rdar://problem/53962833>
+
+ Reviewed by Youenn Fablet.
+
+ Update the Notification API implementation to null-check the page before using. The page becomes null
+ when using the API in a frame that gets detached from its parent while in the middle of running
+ script.
+
+ Test: http/tests/notifications/request-in-detached-frame.html
+
+ * Modules/notifications/Notification.cpp:
+ (WebCore::Notification::permission):
+ (WebCore::Notification::requestPermission):
+
+2019-08-28 Kocsen Chung <[email protected]>
+
Cherry-pick r249154. rdar://problem/54775050
Disabled devices should not be taken into account when searching for a capture device
Modified: branches/safari-608-branch/Source/WebCore/Modules/notifications/Notification.cpp (249238 => 249239)
--- branches/safari-608-branch/Source/WebCore/Modules/notifications/Notification.cpp 2019-08-29 05:57:06 UTC (rev 249238)
+++ branches/safari-608-branch/Source/WebCore/Modules/notifications/Notification.cpp 2019-08-29 05:57:12 UTC (rev 249239)
@@ -166,12 +166,20 @@
auto Notification::permission(Document& document) -> Permission
{
+ auto* page = document.page();
+ if (!page)
+ return Permission::Default;
+
return NotificationController::from(document.page())->client().checkPermission(&document);
}
void Notification::requestPermission(Document& document, RefPtr<NotificationPermissionCallback>&& callback)
{
- NotificationController::from(document.page())->client().requestPermission(&document, WTFMove(callback));
+ auto* page = document.page();
+ if (!page)
+ return;
+
+ NotificationController::from(page)->client().requestPermission(&document, WTFMove(callback));
}
} // namespace WebCore
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
