Changeset 106722 in webkit

Timestamp:

Feb 3, 2012, 5:45:14 PM (15 years ago)

Author:

dslomov@google.com

Message:

[Chromium] WebCore::toV8Context crashes if DomWindow::frame() returns null.
​https://bugs.webkit.org/show_bug.cgi?id=77686.

Reviewed by Adam Barth.

• bindings/v8/V8Helpers.cpp:

(WebCore::toV8Context):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• bindings/v8/V8Helpers.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-02-03  Dmitry Lomov  <dslomov@google.com>
+
+        [Chromium] WebCore::toV8Context crashes if DomWindow::frame() returns null.
+        https://bugs.webkit.org/show_bug.cgi?id=77686.
+
+        Reviewed by Adam Barth.
+
+        * bindings/v8/V8Helpers.cpp:
+        (WebCore::toV8Context):
+
 2012-02-03  Anders Carlsson  <andersca@apple.com>
 

trunk/Source/WebCore/bindings/v8/V8Helpers.cpp

@@ -43 +43 @@
     V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
     DOMWindow* domWindow = object->rootObject;
-    if (!domWindow || domWindow != domWindow->frame()->domWindow())
+    if (!domWindow || !domWindow->frame() || domWindow != domWindow->frame()->domWindow())
         return v8::Local<v8::Context>();
     return V8Proxy::mainWorldContext(object->rootObject->frame());