Changeset 243738 in webkit

Timestamp:

Apr 1, 2019, 11:44:45 PM (7 years ago)

Author:

rniwa@webkit.org

Message:

Nullptr crash in Document::open after calling policyChecker().stopCheck()
​https://bugs.webkit.org/show_bug.cgi?id=196479

Reviewed by Antti Koivisto.

Added a missing nullptr check in Document::open after calling m_frame->loader().policyChecker().stopCheck()
since it invokes m_willSubmitFormCompletionHandlers in WebKit2, and that could clear m_frame.

Unfortunately, we don't have any reproducible test case.

• dom/Document.cpp:

(WebCore::Document::open):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• dom/Document.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-04-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Nullptr crash in Document::open after calling policyChecker().stopCheck()
+        https://bugs.webkit.org/show_bug.cgi?id=196479
+
+        Reviewed by Antti Koivisto.
+
+        Added a missing nullptr check in Document::open after calling m_frame->loader().policyChecker().stopCheck()
+        since it invokes m_willSubmitFormCompletionHandlers in WebKit2, and that could clear m_frame.
+
+        Unfortunately, we don't have any reproducible test case.
+
+        * dom/Document.cpp:
+        (WebCore::Document::open):
+
 2019-04-01  Timothy Hatcher  <timothy@apple.com>
 

trunk/Source/WebCore/dom/Document.cpp

@@ -2739 +2739 @@
         if (m_frame->loader().policyChecker().delegateIsDecidingNavigationPolicy())
             m_frame->loader().policyChecker().stopCheck();
-        if (m_frame->loader().state() == FrameStateProvisional)
+        if (m_frame && m_frame->loader().state() == FrameStateProvisional)
             m_frame->loader().stopAllLoaders();
     }