Title: [257445] releases/WebKitGTK/webkit-2.28/Source/WebCore
- Revision
- 257445
- Author
- [email protected]
- Date
- 2020-02-26 02:57:07 -0800 (Wed, 26 Feb 2020)
Log Message
Merge r257123 - Fix crash in Page::updateRendering when document has no domWindow
https://bugs.webkit.org/show_bug.cgi?id=207975
<rdar://56999099>
Patch by Sunny He <[email protected]> on 2020-02-20
Reviewed by Ryosuke Niwa.
When a subframe is navigated, a new document is created and
the window is transfered asynchronously. It is possible to have
a call to updateRendering in the middle of this process, resulting
in an attempt to update a document with no window. Add a check for
this case and skip such documents.
No test, since this crash relies on sensitive timing that cannot be
consistently replicated in a test case.
* page/Page.cpp:
(WebCore::Page::updateRendering):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.28/Source/WebCore/ChangeLog (257444 => 257445)
--- releases/WebKitGTK/webkit-2.28/Source/WebCore/ChangeLog 2020-02-26 10:57:04 UTC (rev 257444)
+++ releases/WebKitGTK/webkit-2.28/Source/WebCore/ChangeLog 2020-02-26 10:57:07 UTC (rev 257445)
@@ -1,3 +1,23 @@
+2020-02-20 Sunny He <[email protected]>
+
+ Fix crash in Page::updateRendering when document has no domWindow
+ https://bugs.webkit.org/show_bug.cgi?id=207975
+ <rdar://56999099>
+
+ Reviewed by Ryosuke Niwa.
+
+ When a subframe is navigated, a new document is created and
+ the window is transfered asynchronously. It is possible to have
+ a call to updateRendering in the middle of this process, resulting
+ in an attempt to update a document with no window. Add a check for
+ this case and skip such documents.
+
+ No test, since this crash relies on sensitive timing that cannot be
+ consistently replicated in a test case.
+
+ * page/Page.cpp:
+ (WebCore::Page::updateRendering):
+
2020-02-20 Alicia Boya García <[email protected]>
[GStreamer] Fix race in TextCombinerGStreamer
Modified: releases/WebKitGTK/webkit-2.28/Source/WebCore/page/Page.cpp (257444 => 257445)
--- releases/WebKitGTK/webkit-2.28/Source/WebCore/page/Page.cpp 2020-02-26 10:57:04 UTC (rev 257444)
+++ releases/WebKitGTK/webkit-2.28/Source/WebCore/page/Page.cpp 2020-02-26 10:57:07 UTC (rev 257445)
@@ -1331,6 +1331,8 @@
});
forEachDocument([] (Document& document) {
+ if (!document.domWindow())
+ return;
DOMHighResTimeStamp timestamp = document.domWindow()->nowTimestamp();
document.updateAnimationsAndSendEvents(timestamp);
// FIXME: Run the fullscreen steps.
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
