Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6b6622bd96de7f729b1231f55778427dc864badd
https://github.com/WebKit/WebKit/commit/6b6622bd96de7f729b1231f55778427dc864badd
Author: Lauro Moura <[email protected]>
Date: 2026-07-08 (Wed, 08 Jul 2026)
Changed paths:
M Source/WebDriver/WebDriverService.cpp
Log Message:
-----------
[WebDriver] Protect session instance in waitForNavigationToComplete callbacks
https://bugs.webkit.org/show_bug.cgi?id=315736
Reviewed by Carlos Garcia Campos and BJ Burg.
Currently, the waitForNavigationToComplete callbacks access
WebDriverService::m_session directly, although this member could be
null if the callback arrives after we started to delete or to replace
the session.
This commit protects the session instance in these callbacks, as just
adding a null check would leave the door open for the callback to be
called on an already replaced session. This creates a temporary cycle
between the Session, the callback, and the SessionHost (who stashes the
pending requests), but the cycle is broken when either the session is
closed or the browser disconnects, flushing the pending requests.
* Source/WebDriver/WebDriverService.cpp:
(WebDriver::WebDriverService::go):
(WebDriver::WebDriverService::getCurrentURL):
(WebDriver::WebDriverService::back):
(WebDriver::WebDriverService::forward):
(WebDriver::WebDriverService::refresh):
(WebDriver::WebDriverService::getTitle):
(WebDriver::WebDriverService::closeWindow):
(WebDriver::WebDriverService::switchToFrame):
(WebDriver::WebDriverService::switchToParentFrame):
(WebDriver::WebDriverService::findElement):
(WebDriver::WebDriverService::findElements):
(WebDriver::WebDriverService::getActiveElement):
(WebDriver::WebDriverService::executeScript):
(WebDriver::WebDriverService::executeAsyncScript):
(WebDriver::WebDriverService::getAllCookies):
(WebDriver::WebDriverService::getNamedCookie):
(WebDriver::WebDriverService::addCookie):
(WebDriver::WebDriverService::deleteCookie):
(WebDriver::WebDriverService::deleteAllCookies):
(WebDriver::WebDriverService::dismissAlert):
(WebDriver::WebDriverService::acceptAlert):
(WebDriver::WebDriverService::getAlertText):
(WebDriver::WebDriverService::sendAlertText):
(WebDriver::WebDriverService::takeScreenshot):
(WebDriver::WebDriverService::takeElementScreenshot):
Canonical link: https://commits.webkit.org/316713@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
