Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 3dd58311bef7ae212a836c082a5d33e19c5b4f1d
https://github.com/WebKit/WebKit/commit/3dd58311bef7ae212a836c082a5d33e19c5b4f1d
Author: Ahmad Saleem <[email protected]>
Date: 2026-10-04 (Sun, 04 Oct 2026)
Changed paths:
M Source/WebCore/dom/UserGestureIndicator.cpp
Log Message:
-----------
Potential null dereference of frame document in
UserGestureToken::forEachImpactedDocument
https://bugs.webkit.org/show_bug.cgi?id=318315
rdar://181103672
Reviewed by Chris Dumez.
When iterating the frame tree to collect same-origin-domain documents
impacted by a user gesture, the code dereferenced localFrame->document()
to fetch its security origin before null-checking the result. A frame
without a document would null-deref.
Null-check the document before dereferencing it, matching the pattern
already used by the ancestor-frame loop just above.
* Source/WebCore/dom/UserGestureIndicator.cpp:
Canonical link: https://commits.webkit.org/322651@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
