Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 1e0fe8b882354c3c876de0e3f92028c8e82ed984
https://github.com/WebKit/WebKit/commit/1e0fe8b882354c3c876de0e3f92028c8e82ed984
Author: David Kilzer <[email protected]>
Date: 2026-09-11 (Fri, 11 Sep 2026)
Changed paths:
A
LayoutTests/storage/filesystemaccess/writable-file-stream-detached-frame-expected.txt
A
LayoutTests/storage/filesystemaccess/writable-file-stream-detached-frame.html
M Source/WebCore/Modules/filesystem/FileSystemWritableFileStreamSink.cpp
Log Message:
-----------
Null-pointer crash in `FileSystemWritableFileStreamSink::write()` when the
document is detached from its frame
<https://bugs.webkit.org/show_bug.cgi?id=323938>
<rdar://164580967>
Reviewed by Youenn Fablet.
`WritableStreamSink::write()` is called with the `ScriptExecutionContext`
of the current realm, and `FileSystemWritableFileStreamSink::write()`
re-derived a global object from it with
`ScriptExecutionContext::globalObject()`. For a `Document` that getter
goes through `Document::frame()`, so it returns null as soon as the
document has been detached from its frame, and
`convertFileSystemWritableChunk()` then dereferenced null when reading
`JSGlobalObject::m_vm` (offset 0x38) at the top of the generated union
converter for `FileSystemWriteChunkType`.
Script of a detached realm can still run - e.g. a microtask that was
queued before the frame went away, or a function of that realm still
referenced from another frame - so a `write()` can reach the sink after
detach. Null-check the global object and error the stream out with
`InvalidStateError` instead, which is what the other
`WritableStreamSink::write()` implementations already do
(`WebTransportSendStreamSink::write()`, `DatagramSink::write()` and
`RTCEncodedStreamProducer::writeFrame()`).
Test: storage/filesystemaccess/writable-file-stream-detached-frame.html
*
LayoutTests/storage/filesystemaccess/writable-file-stream-detached-frame-expected.txt:
Added.
*
LayoutTests/storage/filesystemaccess/writable-file-stream-detached-frame.html:
Added.
* Source/WebCore/Modules/filesystem/FileSystemWritableFileStreamSink.cpp:
(WebCore::convertFileSystemWritableChunk): Derive the `JSDOMGlobalObject`
from the context here and return an `InvalidStateError` exception when it
is null, so a detached realm is handled through the existing exception path.
(WebCore::FileSystemWritableFileStreamSink::write): Pass the context to
`convertFileSystemWritableChunk()` and reject and abort the writable via
its returned exception, dropping the separate null global object check.
Canonical link: https://commits.webkit.org/320949@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
