Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 95ebe6ad7707ab559ca2cde084236f834deafaab
https://github.com/WebKit/WebKit/commit/95ebe6ad7707ab559ca2cde084236f834deafaab
Author: Zak Ridouh <[email protected]>
Date: 2026-08-27 (Thu, 27 Aug 2026)
Changed paths:
A LayoutTests/fast/parser/resources/xml-parser-end-detach-frame.xhtml
A
LayoutTests/fast/parser/xml-parser-end-detach-crash-frame-removal-expected.txt
A LayoutTests/fast/parser/xml-parser-end-detach-crash-frame-removal.html
A
LayoutTests/fast/parser/xml-parser-end-detach-crash-window-stop-expected.txt
A LayoutTests/fast/parser/xml-parser-end-detach-crash-window-stop.xhtml
M Source/WebCore/xml/parser/XMLDocumentParser.cpp
Log Message:
-----------
Cherry-pick 319245@main (cee623c24bfc).
https://bugs.webkit.org/show_bug.cgi?id=320262
Null Document dereference in XMLDocumentParser::end() when readystatechange
detaches the parser
https://bugs.webkit.org/show_bug.cgi?id=320262
rdar://183186440
Reviewed by David Kilzer.
XMLDocumentParser::end() dispatches readystatechange by calling
Document::setReadyState(Interactive), which can run arbitrary script, and
then
kept using document() unconditionally. Script run from that event can
detach the
parser -- for example window.stop(), which calls DocumentParser::finish()
re-entrantly and reaches Document::finishedParsing(), or removing the frame
the
XML document is loaded in -- after which document() is null and
document()->finishedParsing() dereferences it. HTMLDocumentParser already
re-checks isDetached() after setting the ready state for this reason; do the
same in XMLDocumentParser::end(), and also re-check after
updateLeafTextNode(),
whose mutation events can run script two lines before another use of
document().
Bailing out is safe because detach() has already cleared the current node
stack.
Tests: fast/parser/xml-parser-end-detach-crash-frame-removal.html
fast/parser/xml-parser-end-detach-crash-window-stop.xhtml
* LayoutTests/fast/parser/resources/xml-parser-end-detach-frame.xhtml:
Added.
(document.onreadystatechange):
*
LayoutTests/fast/parser/xml-parser-end-detach-crash-frame-removal-expected.txt:
Added.
* LayoutTests/fast/parser/xml-parser-end-detach-crash-frame-removal.html:
Added.
*
LayoutTests/fast/parser/xml-parser-end-detach-crash-window-stop-expected.txt:
Added.
* LayoutTests/fast/parser/xml-parser-end-detach-crash-window-stop.xhtml:
Added.
* Source/WebCore/xml/parser/XMLDocumentParser.cpp:
(WebCore::XMLDocumentParser::end):
Canonical link: https://commits.webkit.org/319245@main
Canonical link: https://commits.webkit.org/317695.155@webkitglib/2.54
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
