Title: [255334] trunk
- Revision
- 255334
- Author
- [email protected]
- Date
- 2020-01-28 19:01:58 -0800 (Tue, 28 Jan 2020)
Log Message
Null deref crash in DOMWindow::scrollBy after evoking updateLayoutIgnorePendingStylesheets()
https://bugs.webkit.org/show_bug.cgi?id=206099
Patch by Pinki Gyanchandani <[email protected]> on 2020-01-28
Reviewed by Ryosuke Niwa
Source/WebCore:
Added null pointer check for frame in scrollBy function before usage.
Test: fast/dom/Window/window-scroll-ignore-null-frame.html
* page/DOMWindow.cpp:
(WebCore::DOMWindow::scrollBy const):
LayoutTests:
Added a regression test to verify the fix.
* fast/dom/Window/window-scroll-ignore-null-frame.html: Added.
* fast/dom/Window/window-scroll-ignore-null-frame-expected.txt: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (255333 => 255334)
--- trunk/LayoutTests/ChangeLog 2020-01-29 02:55:13 UTC (rev 255333)
+++ trunk/LayoutTests/ChangeLog 2020-01-29 03:01:58 UTC (rev 255334)
@@ -1,3 +1,15 @@
+2020-01-28 Pinki Gyanchandani <[email protected]>
+
+ Null deref crash in DOMWindow::scrollBy after evoking updateLayoutIgnorePendingStylesheets()
+ https://bugs.webkit.org/show_bug.cgi?id=206099
+
+ Reviewed by Ryosuke Niwa
+
+ Added a regression test to verify the fix.
+
+ * fast/dom/Window/window-scroll-ignore-null-frame.html: Added.
+ * fast/dom/Window/window-scroll-ignore-null-frame-expected.txt: Added.
+
2020-01-28 Zalan Bujtas <[email protected]>
REGRESSION: [ Mac ] fast/hidpi/image-srcset-relative-svg-canvas-2x.html is a flaky failure
Added: trunk/LayoutTests/fast/dom/Window/window-scroll-ignore-null-frame-expected.txt (0 => 255334)
--- trunk/LayoutTests/fast/dom/Window/window-scroll-ignore-null-frame-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/Window/window-scroll-ignore-null-frame-expected.txt 2020-01-29 03:01:58 UTC (rev 255334)
@@ -0,0 +1,4 @@
+
+Testcase passes if there is no crash
+
+
Added: trunk/LayoutTests/fast/dom/Window/window-scroll-ignore-null-frame.html (0 => 255334)
--- trunk/LayoutTests/fast/dom/Window/window-scroll-ignore-null-frame.html (rev 0)
+++ trunk/LayoutTests/fast/dom/Window/window-scroll-ignore-null-frame.html 2020-01-29 03:01:58 UTC (rev 255334)
@@ -0,0 +1,24 @@
+<html>
+<script>
+
+function runTest() {
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ select1.appendChild(inputParent);
+ input1.autofocus = true;
+ input1.setSelectionRange(1, 0);
+ document.body.appendChild(input1);
+ frame1.contentWindow.scrollBy({left: 1, top: 0});
+}
+
+</script>
+
+<body _onload_=runTest()>
+<iframe id="frame1"></iframe>
+<div style="display: none" id="inputParent"><input id="input1"></div>
+<select id="select1" _onblur_="inputParent.appendChild(frame1)"></select>
+<p>Testcase passes if there is no crash </p>
+
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (255333 => 255334)
--- trunk/Source/WebCore/ChangeLog 2020-01-29 02:55:13 UTC (rev 255333)
+++ trunk/Source/WebCore/ChangeLog 2020-01-29 03:01:58 UTC (rev 255334)
@@ -1,3 +1,17 @@
+2020-01-28 Pinki Gyanchandani <[email protected]>
+
+ Null deref crash in DOMWindow::scrollBy after evoking updateLayoutIgnorePendingStylesheets()
+ https://bugs.webkit.org/show_bug.cgi?id=206099
+
+ Reviewed by Ryosuke Niwa
+
+ Added null pointer check for frame in scrollBy function before usage.
+
+ Test: fast/dom/Window/window-scroll-ignore-null-frame.html
+
+ * page/DOMWindow.cpp:
+ (WebCore::DOMWindow::scrollBy const):
+
2020-01-28 Chris Dumez <[email protected]>
REGRESSION (r252064): [ Mac iOS ] storage/websql/statement-error-callback.html is timing out flakily
Modified: trunk/Source/WebCore/page/DOMWindow.cpp (255333 => 255334)
--- trunk/Source/WebCore/page/DOMWindow.cpp 2020-01-29 02:55:13 UTC (rev 255333)
+++ trunk/Source/WebCore/page/DOMWindow.cpp 2020-01-29 03:01:58 UTC (rev 255334)
@@ -1683,7 +1683,11 @@
document()->updateLayoutIgnorePendingStylesheets();
- FrameView* view = frame()->view();
+ auto* frame = this->frame();
+ if (!frame)
+ return;
+
+ auto view = makeRefPtr(frame->view());
if (!view)
return;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
