Changeset 194283 in webkit

Timestamp:

Dec 18, 2015, 11:49:58 AM (11 years ago)

Author:

bshafiei@apple.com

Message:

Merged r192582. rdar://problem/23957053

Location:

branches/safari-601.1.46-branch/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• page/DOMWindow.cpp (modified) (2 diffs)
• page/Performance.cpp (modified) (5 diffs)
• page/Performance.h (modified) (2 diffs)

branches/safari-601.1.46-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2015-12-18  Babak Shafiei  <bshafiei@apple.com>
+
+        Merge r192582.
+
+    2015-11-18  Chris Dumez  <cdumez@apple.com>
+
+            Null dereference in Performance::Performance(WebCore::Frame*)
+            https://bugs.webkit.org/show_bug.cgi?id=151390
+
+            Reviewed by Brady Eidson.
+
+            Based on the stack trace, it appears the DocumentLoader can be null
+            when constructing the Performance object. This patch thus adds a null
+            check before trying to dereference it.
+
+            No new tests, was not able to reproduce.
+
+            * page/DOMWindow.cpp:
+            (WebCore::DOMWindow::navigator):
+            (WebCore::DOMWindow::performance):
+            * page/Performance.cpp:
+            (WebCore::Performance::Performance):
+            (WebCore::Performance::scriptExecutionContext):
+            * page/Performance.h:
+
 2015-12-17  Matthew Hanson  <matthew_hanson@apple.com>
 

branches/safari-601.1.46-branch/Source/WebCore/page/DOMWindow.cpp

@@ -725 +725 @@
 {
     if (!isCurrentlyDisplayedInFrame())
-        return 0;
+        return nullptr;
     if (!m_navigator)
         m_navigator = Navigator::create(m_frame);
@@ -735 +735 @@
 {
     if (!isCurrentlyDisplayedInFrame())
-        return 0;
+        return nullptr;
     if (!m_performance)
-        m_performance = Performance::create(m_frame);
+        m_performance = Performance::create(*m_frame);
     return m_performance.get();
 }

branches/safari-601.1.46-branch/Source/WebCore/page/Performance.cpp

@@ -31 +31 @@
 
 #include "config.h"
+
+#if ENABLE(WEB_TIMING)
 #include "Performance.h"
 
 #include "Document.h"
 #include "DocumentLoader.h"
+#include "Frame.h"
 #include "PerformanceEntry.h"
 #include "PerformanceNavigation.h"
@@ -43 +46 @@
 #include <wtf/CurrentTime.h>
 
-#if ENABLE(WEB_TIMING)
-
-#include "Frame.h"
-
 namespace WebCore {
 
@@ -53 +52 @@
 #endif
 
-Performance::Performance(Frame* frame)
-    : DOMWindowProperty(frame)
+Performance::Performance(Frame& frame)
+    : DOMWindowProperty(&frame)
 #if ENABLE(RESOURCE_TIMING)
     , m_resourceTimingBufferSize(defaultResourceTimingBufferSize)
 #endif // ENABLE(RESOURCE_TIMING)
-    , m_referenceTime(frame->document()->loader()->timing().referenceMonotonicTime())
+    , m_referenceTime(frame.document()->loader() ? frame.document()->loader()->timing().referenceMonotonicTime() : monotonicallyIncreasingTime())
 #if ENABLE(USER_TIMING)
     , m_userTiming(nullptr)
@@ -73 +72 @@
 {
     if (!frame())
-        return 0;
+        return nullptr;
     return frame()->document();
 }
@@ -232 +231 @@
 double Performance::now() const
 {
-    double nowSeconds = WTF::monotonicallyIncreasingTime() - m_referenceTime;
+    double nowSeconds = monotonicallyIncreasingTime() - m_referenceTime;
     const double resolutionSeconds = 0.000005;
     return 1000.0 * floor(nowSeconds / resolutionSeconds) * resolutionSeconds;

branches/safari-601.1.46-branch/Source/WebCore/page/Performance.h

@@ -55 +55 @@
 class Performance final : public ScriptWrappable, public RefCounted<Performance>, public DOMWindowProperty, public EventTargetWithInlineData {
 public:
-    static Ref<Performance> create(Frame* frame) { return adoptRef(*new Performance(frame)); }
+    static Ref<Performance> create(Frame& frame) { return adoptRef(*new Performance(frame)); }
     ~Performance();
 
@@ -90 +90 @@
 
 private:
-    explicit Performance(Frame*);
+    explicit Performance(Frame&);
 
     virtual void refEventTarget() override { ref(); }