Branch: refs/heads/webkitglib/2.48
Home: https://github.com/WebKit/WebKit
Commit: dff2f9a594040ecdfd64a07016ae3f39dad7e471
https://github.com/WebKit/WebKit/commit/dff2f9a594040ecdfd64a07016ae3f39dad7e471
Author: Alex Christensen <[email protected]>
Date: 2025-07-02 (Wed, 02 Jul 2025)
Changed paths:
M Source/WebCore/bindings/js/SerializedScriptValue.cpp
Log Message:
-----------
Cherry-pick 296463@main (bce364df2fa7).
https://bugs.webkit.org/show_bug.cgi?id=294770
CloneDeserializer should check m_isDOMGlobalObject or m_canCreateDOMObject
before casting m_globalObject to JSDOMGlobalObject
https://bugs.webkit.org/show_bug.cgi?id=294770
rdar://153031210
Reviewed by Chris Dumez.
Otherwise we'll dereference null. This can happen when
SerializedScriptValue is used in non-DOM contexts, such as
UserMessageHandler.postMessage.
* Source/WebCore/bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneDeserializer::getJSValue):
(WebCore::CloneDeserializer::readDOMPoint):
(WebCore::CloneDeserializer::readDOMMatrix):
(WebCore::CloneDeserializer::readDOMRect):
(WebCore::CloneDeserializer::readDOMQuad):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/WKWebViewEvaluateJavaScript.mm:
(TEST(WKWebView, EvaluateJavaScriptErrorCases)):
Canonical link: https://commits.webkit.org/296463@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
