Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: cee623c24bfce90c11aa34ff96fa5b6dbd884e9b
https://github.com/WebKit/WebKit/commit/cee623c24bfce90c11aa34ff96fa5b6dbd884e9b
Author: Zak Ridouh <[email protected]>
Date: 2026-08-15 (Sat, 15 Aug 2026)
Changed paths:
A LayoutTests/fast/parser/resources/xml-parser-end-detach-frame.xhtml
A
LayoutTests/fast/parser/xml-parser-end-detach-crash-frame-removal-expected.txt
A LayoutTests/fast/parser/xml-parser-end-detach-crash-frame-removal.html
A
LayoutTests/fast/parser/xml-parser-end-detach-crash-window-stop-expected.txt
A LayoutTests/fast/parser/xml-parser-end-detach-crash-window-stop.xhtml
M Source/WebCore/xml/parser/XMLDocumentParser.cpp
Log Message:
-----------
Null Document dereference in XMLDocumentParser::end() when readystatechange
detaches the parser
https://bugs.webkit.org/show_bug.cgi?id=320262
rdar://183186440
Reviewed by David Kilzer.
XMLDocumentParser::end() dispatches readystatechange by calling
Document::setReadyState(Interactive), which can run arbitrary script, and then
kept using document() unconditionally. Script run from that event can detach the
parser -- for example window.stop(), which calls DocumentParser::finish()
re-entrantly and reaches Document::finishedParsing(), or removing the frame the
XML document is loaded in -- after which document() is null and
document()->finishedParsing() dereferences it. HTMLDocumentParser already
re-checks isDetached() after setting the ready state for this reason; do the
same in XMLDocumentParser::end(), and also re-check after updateLeafTextNode(),
whose mutation events can run script two lines before another use of document().
Bailing out is safe because detach() has already cleared the current node stack.
Tests: fast/parser/xml-parser-end-detach-crash-frame-removal.html
fast/parser/xml-parser-end-detach-crash-window-stop.xhtml
* LayoutTests/fast/parser/resources/xml-parser-end-detach-frame.xhtml: Added.
(document.onreadystatechange):
*
LayoutTests/fast/parser/xml-parser-end-detach-crash-frame-removal-expected.txt:
Added.
* LayoutTests/fast/parser/xml-parser-end-detach-crash-frame-removal.html: Added.
* LayoutTests/fast/parser/xml-parser-end-detach-crash-window-stop-expected.txt:
Added.
* LayoutTests/fast/parser/xml-parser-end-detach-crash-window-stop.xhtml: Added.
* Source/WebCore/xml/parser/XMLDocumentParser.cpp:
(WebCore::XMLDocumentParser::end):
Canonical link: https://commits.webkit.org/319245@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
