Changeset 245923 in webkit

Timestamp:

May 30, 2019, 5:30:07 PM (7 years ago)

Author:

Alan Coon

Message:

Cherry-pick r245464. rdar://problem/51264866

Hardening: Prevent FrameLoader crash due to SetForScope
​https://bugs.webkit.org/show_bug.cgi?id=197458
<rdar://problem/50368338>

Reviewed by Chris Dumez.

Since SetForScope takes action during a function returns, it might cause
a crash if its scope is broader than the value it is resetting.

• loader/FrameLoader.cpp: (WebCore::FrameLoader::loadDifferentDocumentItem):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@245464 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-607-branch/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• loader/FrameLoader.cpp (modified) (1 diff)

branches/safari-607-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
+
+        Cherry-pick r245464. rdar://problem/51264866
+
+    Hardening: Prevent FrameLoader crash due to SetForScope
+    https://bugs.webkit.org/show_bug.cgi?id=197458
+    <rdar://problem/50368338>
+    
+    Reviewed by Chris Dumez.
+    
+    Since SetForScope takes action during a function returns, it might cause
+    a crash if its scope is broader than the value it is resetting.
+    
+    * loader/FrameLoader.cpp:
+    (WebCore::FrameLoader::loadDifferentDocumentItem):
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245464 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-05-17  Brent Fulgham  <bfulgham@apple.com>
+
+            Hardening: Prevent FrameLoader crash due to SetForScope
+            https://bugs.webkit.org/show_bug.cgi?id=197458
+            <rdar://problem/50368338>
+
+            Reviewed by Chris Dumez.
+
+            Since SetForScope takes action during a function returns, it might cause
+            a crash if its scope is broader than the value it is resetting.
+
+            * loader/FrameLoader.cpp:
+            (WebCore::FrameLoader::loadDifferentDocumentItem):
+
 2019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
 

branches/safari-607-branch/Source/WebCore/loader/FrameLoader.cpp

@@ -3667 +3667 @@
     RELEASE_LOG_IF_ALLOWED("loadDifferentDocumentItem: frame load started (frame = %p, main = %d)", &m_frame, m_frame.isMainFrame());
 
+    Ref<Frame> protectedFrame(m_frame);
+
     // History items should not be reported to the parent.
     m_shouldReportResourceTimingToParentFrame = false;