Changeset 249239 in webkit

Timestamp:

Aug 28, 2019, 10:57:12 PM (7 years ago)

Author:

Kocsen Chung

Message:

Cherry-pick r249156. rdar://problem/54775048

Crash under WebCore::jsNotificationConstructorPermission
​https://bugs.webkit.org/show_bug.cgi?id=201186
<rdar://problem/53962833>

Reviewed by Youenn Fablet.

Source/WebCore:

Update the Notification API implementation to null-check the page before using. The page becomes null
when using the API in a frame that gets detached from its parent while in the middle of running
script.

Test: http/tests/notifications/request-in-detached-frame.html

• Modules/notifications/Notification.cpp: (WebCore::Notification::permission): (WebCore::Notification::requestPermission):

LayoutTests:

Add layout test coverage.

• http/tests/notifications/request-in-detached-frame-expected.txt: Added.
• http/tests/notifications/request-in-detached-frame.html: Added.
• http/tests/notifications/resources/request-in-detached-frame-subframe.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@249156 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-608-branch

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/notifications/request-in-detached-frame-expected.txt (added)
• LayoutTests/http/tests/notifications/request-in-detached-frame.html (added)
• LayoutTests/http/tests/notifications/resources/request-in-detached-frame-subframe.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/Modules/notifications/Notification.cpp (modified) (2 diffs)

branches/safari-608-branch/LayoutTests/ChangeLog

@@ +1 @@
+2019-08-28  Kocsen Chung  <kocsen_chung@apple.com>
+
+        Cherry-pick r249156. rdar://problem/54775048
+
+    Crash under WebCore::jsNotificationConstructorPermission
+    https://bugs.webkit.org/show_bug.cgi?id=201186
+    <rdar://problem/53962833>
+    
+    Reviewed by Youenn Fablet.
+    
+    Source/WebCore:
+    
+    Update the Notification API implementation to null-check the page before using. The page becomes null
+    when using the API in a frame that gets detached from its parent while in the middle of running
+    script.
+    
+    Test: http/tests/notifications/request-in-detached-frame.html
+    
+    * Modules/notifications/Notification.cpp:
+    (WebCore::Notification::permission):
+    (WebCore::Notification::requestPermission):
+    
+    LayoutTests:
+    
+    Add layout test coverage.
+    
+    * http/tests/notifications/request-in-detached-frame-expected.txt: Added.
+    * http/tests/notifications/request-in-detached-frame.html: Added.
+    * http/tests/notifications/resources/request-in-detached-frame-subframe.html: Added.
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@249156 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-08-27  Chris Dumez  <cdumez@apple.com>
+
+            Crash under WebCore::jsNotificationConstructorPermission
+            https://bugs.webkit.org/show_bug.cgi?id=201186
+            <rdar://problem/53962833>
+
+            Reviewed by Youenn Fablet.
+
+            Add layout test coverage.
+
+            * http/tests/notifications/request-in-detached-frame-expected.txt: Added.
+            * http/tests/notifications/request-in-detached-frame.html: Added.
+            * http/tests/notifications/resources/request-in-detached-frame-subframe.html: Added.
+
 2019-08-27  Ryan Haddad  <ryanhaddad@apple.com>
 

branches/safari-608-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2019-08-28  Kocsen Chung  <kocsen_chung@apple.com>
+
+        Cherry-pick r249156. rdar://problem/54775048
+
+    Crash under WebCore::jsNotificationConstructorPermission
+    https://bugs.webkit.org/show_bug.cgi?id=201186
+    <rdar://problem/53962833>
+    
+    Reviewed by Youenn Fablet.
+    
+    Source/WebCore:
+    
+    Update the Notification API implementation to null-check the page before using. The page becomes null
+    when using the API in a frame that gets detached from its parent while in the middle of running
+    script.
+    
+    Test: http/tests/notifications/request-in-detached-frame.html
+    
+    * Modules/notifications/Notification.cpp:
+    (WebCore::Notification::permission):
+    (WebCore::Notification::requestPermission):
+    
+    LayoutTests:
+    
+    Add layout test coverage.
+    
+    * http/tests/notifications/request-in-detached-frame-expected.txt: Added.
+    * http/tests/notifications/request-in-detached-frame.html: Added.
+    * http/tests/notifications/resources/request-in-detached-frame-subframe.html: Added.
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@249156 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-08-27  Chris Dumez  <cdumez@apple.com>
+
+            Crash under WebCore::jsNotificationConstructorPermission
+            https://bugs.webkit.org/show_bug.cgi?id=201186
+            <rdar://problem/53962833>
+
+            Reviewed by Youenn Fablet.
+
+            Update the Notification API implementation to null-check the page before using. The page becomes null
+            when using the API in a frame that gets detached from its parent while in the middle of running
+            script.
+
+            Test: http/tests/notifications/request-in-detached-frame.html
+
+            * Modules/notifications/Notification.cpp:
+            (WebCore::Notification::permission):
+            (WebCore::Notification::requestPermission):
+
 2019-08-28  Kocsen Chung  <kocsen_chung@apple.com>
 

branches/safari-608-branch/Source/WebCore/Modules/notifications/Notification.cpp

@@ -167 +167 @@
 auto Notification::permission(Document& document) -> Permission
 {
+    auto* page = document.page();
+    if (!page)
+        return Permission::Default;
+
     return NotificationController::from(document.page())->client().checkPermission(&document);
 }
@@ -172 +176 @@
 void Notification::requestPermission(Document& document, RefPtr<NotificationPermissionCallback>&& callback)
 {
-    NotificationController::from(document.page())->client().requestPermission(&document, WTFMove(callback));
+    auto* page = document.page();
+    if (!page)
+        return;
+
+    NotificationController::from(page)->client().requestPermission(&document, WTFMove(callback));
 }