Changeset 271239 in webkit

Timestamp:

Jan 7, 2021, 9:23:23 AM (6 years ago)

Author:

commit-queue@webkit.org

Message:

Null check global object in Blob::stream
​https://bugs.webkit.org/show_bug.cgi?id=220393
<rdar://problem/71626701>

Patch by Alex Christensen <​achristensen@webkit.org> on 2021-01-07
Reviewed by Chris Dumez.

Source/WebCore:

Sometimes during a frame teardown we could dereference null.
Attached a test that hit it about 10% of the time for me in WebKitTestRunner before this change.

Test: fast/files/blob-stream-crash.html

• fileapi/Blob.cpp:

(WebCore::Blob::stream):

LayoutTests:

• fast/files/blob-stream-crash-expected.txt: Added.
• fast/files/blob-stream-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/files/blob-stream-crash-expected.txt (added)
• LayoutTests/fast/files/blob-stream-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/fileapi/Blob.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-01-07  Alex Christensen  <achristensen@webkit.org>
+
+        Null check global object in Blob::stream
+        https://bugs.webkit.org/show_bug.cgi?id=220393
+        <rdar://problem/71626701>
+
+        Reviewed by Chris Dumez.
+
+        * fast/files/blob-stream-crash-expected.txt: Added.
+        * fast/files/blob-stream-crash.html: Added.
+
 2021-01-07  Lauro Moura  <lmoura@igalia.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-01-07  Alex Christensen  <achristensen@webkit.org>
+
+        Null check global object in Blob::stream
+        https://bugs.webkit.org/show_bug.cgi?id=220393
+        <rdar://problem/71626701>
+
+        Reviewed by Chris Dumez.
+
+        Sometimes during a frame teardown we could dereference null.
+        Attached a test that hit it about 10% of the time for me in WebKitTestRunner before this change.
+
+        Test: fast/files/blob-stream-crash.html
+
+        * fileapi/Blob.cpp:
+        (WebCore::Blob::stream):
+
 2021-01-07  Lauro Moura  <lmoura@igalia.com>
 

trunk/Source/WebCore/fileapi/Blob.cpp

@@ -278 +278 @@
     };
 
-    return ReadableStream::create(*scriptExecutionContext.globalObject(), adoptRef(*new BlobStreamSource(scriptExecutionContext, *this)));
+    auto* globalObject = scriptExecutionContext.globalObject();
+    if (!globalObject)
+        return Exception { InvalidStateError };
+    return ReadableStream::create(*globalObject, adoptRef(*new BlobStreamSource(scriptExecutionContext, *this)));
 }