Changeset 249156 in webkit

Timestamp:

Aug 27, 2019, 11:38:41 AM (7 years ago)

Author:

Chris Dumez

Message:

Crash under WebCore::jsNotificationConstructorPermission
​https://bugs.webkit.org/show_bug.cgi?id=201186
<rdar://problem/53962833>

Reviewed by Youenn Fablet.

Source/WebCore:

Update the Notification API implementation to null-check the page before using. The page becomes null
when using the API in a frame that gets detached from its parent while in the middle of running
script.

Test: http/tests/notifications/request-in-detached-frame.html

• Modules/notifications/Notification.cpp:

(WebCore::Notification::permission):
(WebCore::Notification::requestPermission):

LayoutTests:

Add layout test coverage.

• http/tests/notifications/request-in-detached-frame-expected.txt: Added.
• http/tests/notifications/request-in-detached-frame.html: Added.
• http/tests/notifications/resources/request-in-detached-frame-subframe.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/notifications/request-in-detached-frame-expected.txt (added)
• LayoutTests/http/tests/notifications/request-in-detached-frame.html (added)
• LayoutTests/http/tests/notifications/resources/request-in-detached-frame-subframe.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/Modules/notifications/Notification.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2019-08-27  Chris Dumez  <cdumez@apple.com>
+
+        Crash under WebCore::jsNotificationConstructorPermission
+        https://bugs.webkit.org/show_bug.cgi?id=201186
+        <rdar://problem/53962833>
+
+        Reviewed by Youenn Fablet.
+
+        Add layout test coverage.
+
+        * http/tests/notifications/request-in-detached-frame-expected.txt: Added.
+        * http/tests/notifications/request-in-detached-frame.html: Added.
+        * http/tests/notifications/resources/request-in-detached-frame-subframe.html: Added.
+
 2019-08-27  Ryan Haddad  <ryanhaddad@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-08-27  Chris Dumez  <cdumez@apple.com>
+
+        Crash under WebCore::jsNotificationConstructorPermission
+        https://bugs.webkit.org/show_bug.cgi?id=201186
+        <rdar://problem/53962833>
+
+        Reviewed by Youenn Fablet.
+
+        Update the Notification API implementation to null-check the page before using. The page becomes null
+        when using the API in a frame that gets detached from its parent while in the middle of running
+        script.
+
+        Test: http/tests/notifications/request-in-detached-frame.html
+
+        * Modules/notifications/Notification.cpp:
+        (WebCore::Notification::permission):
+        (WebCore::Notification::requestPermission):
+
 2019-08-27  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebCore/Modules/notifications/Notification.cpp

@@ -167 +167 @@
 auto Notification::permission(Document& document) -> Permission
 {
+    auto* page = document.page();
+    if (!page)
+        return Permission::Default;
+
     return NotificationController::from(document.page())->client().checkPermission(&document);
 }
@@ -172 +176 @@
 void Notification::requestPermission(Document& document, RefPtr<NotificationPermissionCallback>&& callback)
 {
-    NotificationController::from(document.page())->client().requestPermission(&document, WTFMove(callback));
+    auto* page = document.page();
+    if (!page)
+        return;
+
+    NotificationController::from(page)->client().requestPermission(&document, WTFMove(callback));
 }