Title: [264880] trunk
- Revision
- 264880
- Author
- [email protected]
- Date
- 2020-07-24 20:10:18 -0700 (Fri, 24 Jul 2020)
Log Message
Null check frame in Document::dispatchDisabledAdaptationsDidChangeForMainFrame and a few other places
https://bugs.webkit.org/show_bug.cgi?id=214715
<rdar://problem/65467702>
Reviewed by Geoffrey Garen.
Source/WebCore:
Test: security/mutation-observer-frame-detach.html
* dom/Document.cpp:
(WebCore::Document::didBecomeCurrentDocumentInFrame):
(WebCore::Document::initContentSecurityPolicy):
* loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::commitData):
Add some null checks and early returns if the frame detaches.
* loader/SubframeLoader.cpp:
(WebCore::FrameLoader::SubframeLoader::loadSubframe):
Balance the call to incrementLoadEventDelayCount in the early return case or this test never finishes loading.
LayoutTests:
* security/mutation-observer-frame-detach-expected.txt: Added.
* security/mutation-observer-frame-detach.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (264879 => 264880)
--- trunk/LayoutTests/ChangeLog 2020-07-25 02:59:34 UTC (rev 264879)
+++ trunk/LayoutTests/ChangeLog 2020-07-25 03:10:18 UTC (rev 264880)
@@ -1,5 +1,16 @@
2020-07-24 Alex Christensen <[email protected]>
+ Null check frame in Document::dispatchDisabledAdaptationsDidChangeForMainFrame and a few other places
+ https://bugs.webkit.org/show_bug.cgi?id=214715
+ <rdar://problem/65467702>
+
+ Reviewed by Geoffrey Garen.
+
+ * security/mutation-observer-frame-detach-expected.txt: Added.
+ * security/mutation-observer-frame-detach.html: Added.
+
+2020-07-24 Alex Christensen <[email protected]>
+
Fix assertion when highlighting in detached frames and make loads complete
https://bugs.webkit.org/show_bug.cgi?id=214770
Added: trunk/LayoutTests/security/mutation-observer-frame-detach-expected.txt (0 => 264880)
--- trunk/LayoutTests/security/mutation-observer-frame-detach-expected.txt (rev 0)
+++ trunk/LayoutTests/security/mutation-observer-frame-detach-expected.txt 2020-07-25 03:10:18 UTC (rev 264880)
@@ -0,0 +1,2 @@
+ALERT: test passed because nothing crashed
+
Added: trunk/LayoutTests/security/mutation-observer-frame-detach.html (0 => 264880)
--- trunk/LayoutTests/security/mutation-observer-frame-detach.html (rev 0)
+++ trunk/LayoutTests/security/mutation-observer-frame-detach.html 2020-07-25 03:10:18 UTC (rev 264880)
@@ -0,0 +1,29 @@
+<script>
+ function runTest() {
+ var observer = new MutationObserver(()=>{p1.replaceWith(p2)});
+ observer.observe(select,{childList:true});
+ select[2] = option;
+ document.head.appendChild(p2);
+ var object = document.createElement("object");
+ var frame = document.createElement("frame");
+ audio.appendChild(option);
+ p1.appendChild(object);
+ object.data = ""
+ document.all[9].appendChild(frame);
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ alert("test passed because nothing crashed");
+ }
+ }
+</script>
+<body _onload_=runTest()>
+ <p id="p1">
+ <p id="p2">
+ <audio id="audio">
+ <select id="select">
+ <option id="option"></option>
+ </select>
+ </audio>
+ </p>
+ </p>
+</body>
Modified: trunk/Source/WebCore/ChangeLog (264879 => 264880)
--- trunk/Source/WebCore/ChangeLog 2020-07-25 02:59:34 UTC (rev 264879)
+++ trunk/Source/WebCore/ChangeLog 2020-07-25 03:10:18 UTC (rev 264880)
@@ -1,5 +1,25 @@
2020-07-24 Alex Christensen <[email protected]>
+ Null check frame in Document::dispatchDisabledAdaptationsDidChangeForMainFrame and a few other places
+ https://bugs.webkit.org/show_bug.cgi?id=214715
+ <rdar://problem/65467702>
+
+ Reviewed by Geoffrey Garen.
+
+ Test: security/mutation-observer-frame-detach.html
+
+ * dom/Document.cpp:
+ (WebCore::Document::didBecomeCurrentDocumentInFrame):
+ (WebCore::Document::initContentSecurityPolicy):
+ * loader/DocumentLoader.cpp:
+ (WebCore::DocumentLoader::commitData):
+ Add some null checks and early returns if the frame detaches.
+ * loader/SubframeLoader.cpp:
+ (WebCore::FrameLoader::SubframeLoader::loadSubframe):
+ Balance the call to incrementLoadEventDelayCount in the early return case or this test never finishes loading.
+
+2020-07-24 Alex Christensen <[email protected]>
+
Fix assertion when highlighting in detached frames and make loads complete
https://bugs.webkit.org/show_bug.cgi?id=214770
Modified: trunk/Source/WebCore/dom/Document.cpp (264879 => 264880)
--- trunk/Source/WebCore/dom/Document.cpp 2020-07-25 02:59:34 UTC (rev 264879)
+++ trunk/Source/WebCore/dom/Document.cpp 2020-07-25 03:10:18 UTC (rev 264880)
@@ -2386,16 +2386,24 @@
void Document::didBecomeCurrentDocumentInFrame()
{
- // FIXME: Are there cases where the document can be dislodged from the frame during the event handling below?
- // If so, then m_frame could become 0, and we need to do something about that.
-
m_frame->script().updateDocument();
+ // Many of these functions have event handlers which can detach the frame synchronously, so we must check repeatedly in this function.
+ if (!m_frame)
+ return;
+
if (!hasLivingRenderTree())
createRenderTree();
+ if (!m_frame)
+ return;
dispatchDisabledAdaptationsDidChangeForMainFrame();
+ if (!m_frame)
+ return;
+
updateViewportArguments();
+ if (!m_frame)
+ return;
// FIXME: Doing this only for the main frame is insufficient.
// Changing a subframe can also change the wheel event handler count.
@@ -2406,6 +2414,8 @@
// unless the documents they are replacing had wheel event handlers.
if (page() && m_frame->isMainFrame())
wheelEventHandlersChanged();
+ if (!m_frame)
+ return;
// Ensure that the scheduled task state of the document matches the DOM suspension state of the frame. It can
// be out of sync if the DOM suspension state changed while the document was not in the frame (possibly in the
@@ -6098,6 +6108,8 @@
void Document::initContentSecurityPolicy()
{
+ if (!m_frame)
+ return;
auto* parentFrame = m_frame->tree().parent();
if (parentFrame)
contentSecurityPolicy()->copyUpgradeInsecureRequestStateFrom(*parentFrame->document()->contentSecurityPolicy());
Modified: trunk/Source/WebCore/loader/DocumentLoader.cpp (264879 => 264880)
--- trunk/Source/WebCore/loader/DocumentLoader.cpp 2020-07-25 02:59:34 UTC (rev 264879)
+++ trunk/Source/WebCore/loader/DocumentLoader.cpp 2020-07-25 03:10:18 UTC (rev 264880)
@@ -1087,7 +1087,10 @@
bool hasBegun = m_writer.begin(documentURL(), false);
m_writer.setDocumentWasLoadedAsPartOfNavigation();
- auto& document = *m_frame->document();
+ auto* documentOrNull = m_frame ? m_frame->document() : nullptr;
+ if (!documentOrNull)
+ return;
+ auto& document = *documentOrNull;
if (SecurityPolicy::allowSubstituteDataAccessToLocal() && m_originalSubstituteDataWasValid) {
// If this document was loaded with substituteData, then the document can
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
