Changeset 276530 in webkit

Timestamp:

Apr 23, 2021, 4:45:57 PM (5 years ago)

Author:

rniwa@webkit.org

Message:

Crash in constructCustomElementSynchronously
​https://bugs.webkit.org/show_bug.cgi?id=224992
<rdar://66988026>

Reviewed by Tadeu Zagallo.

Exit early when the global object is nullptr although this shouldn't happen.

No new tests since we have no reproductions.

• bindings/js/JSCustomElementInterface.cpp:

(WebCore::JSCustomElementInterface::tryToConstructCustomElement): Added a null check.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• bindings/js/JSCustomElementInterface.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-04-23  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in constructCustomElementSynchronously
+        https://bugs.webkit.org/show_bug.cgi?id=224992
+        <rdar://66988026>
+
+        Reviewed by Tadeu Zagallo.
+
+        Exit early when the global object is nullptr although this shouldn't happen.
+
+        No new tests since we have no reproductions.
+
+        * bindings/js/JSCustomElementInterface.cpp:
+        (WebCore::JSCustomElementInterface::tryToConstructCustomElement): Added a null check.
+
 2021-04-23  Don Olmstead  <don.olmstead@sony.com>
 

trunk/Source/WebCore/bindings/js/JSCustomElementInterface.cpp

@@ -100 +100 @@
 
     ASSERT(&document == scriptExecutionContext());
-    auto& lexicalGlobalObject = *document.globalObject();
-    auto element = constructCustomElementSynchronously(document, vm, lexicalGlobalObject, m_constructor.get(), localName);
+    auto* lexicalGlobalObject = document.globalObject();
+    ASSERT(lexicalGlobalObject);
+    if (!lexicalGlobalObject)
+        return nullptr;
+    auto element = constructCustomElementSynchronously(document, vm, *lexicalGlobalObject, m_constructor.get(), localName);
     EXCEPTION_ASSERT(!!scope.exception() == !element);
     if (!element) {
         auto* exception = scope.exception();
         scope.clearException();
-        reportException(&lexicalGlobalObject, exception);
+        reportException(lexicalGlobalObject, exception);
         return nullptr;
     }