Changeset 285179 in webkit

Timestamp:

Nov 2, 2021, 1:44:33 PM (5 years ago)

Author:

Chris Dumez

Message:

Crash under WebPage::sendCOEPCORPViolation()
​https://bugs.webkit.org/show_bug.cgi?id=232631
<rdar://84919898>

Reviewed by Alex Christensen.

Add missing null checks for the frame after calling WebProcess::singleton().webFrame(frameID).

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::sendCOEPPolicyInheritenceViolation):
(WebKit::WebPage::sendCOEPCORPViolation):
(WebKit::WebPage::sendViolationReportWhenNavigatingToCOOPResponse):
(WebKit::WebPage::sendViolationReportWhenNavigatingAwayFromCOOPResponse):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/WebPage/WebPage.cpp (modified) (4 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-11-02  Chris Dumez  <cdumez@apple.com>
+
+        Crash under WebPage::sendCOEPCORPViolation()
+        https://bugs.webkit.org/show_bug.cgi?id=232631
+        <rdar://84919898>
+
+        Reviewed by Alex Christensen.
+
+        Add missing null checks for the frame after calling `WebProcess::singleton().webFrame(frameID)`.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::sendCOEPPolicyInheritenceViolation):
+        (WebKit::WebPage::sendCOEPCORPViolation):
+        (WebKit::WebPage::sendViolationReportWhenNavigatingToCOOPResponse):
+        (WebKit::WebPage::sendViolationReportWhenNavigatingAwayFromCOOPResponse):
+
 2021-11-02  Sihui Liu  <sihui_liu@apple.com>
 

trunk/Source/WebKit/WebProcess/WebPage/WebPage.cpp

@@ -4320 +4320 @@
 void WebPage::sendCOEPPolicyInheritenceViolation(FrameIdentifier frameID, const SecurityOriginData& embedderOrigin, const String& endpoint, COEPDisposition disposition, const String& type, const URL& blockedURL)
 {
-    if (auto* frame = WebProcess::singleton().webFrame(frameID); frame->coreFrame())
+    if (auto* frame = WebProcess::singleton().webFrame(frameID); frame && frame->coreFrame())
         WebCore::sendCOEPPolicyInheritenceViolation(*frame->coreFrame(), embedderOrigin, endpoint, disposition, type, blockedURL);
 }
@@ -4326 +4326 @@
 void WebPage::sendCOEPCORPViolation(FrameIdentifier frameID, const SecurityOriginData& embedderOrigin, const String& endpoint, COEPDisposition disposition, FetchOptions::Destination destination, const URL& blockedURL)
 {
-    if (auto* frame = WebProcess::singleton().webFrame(frameID); frame->coreFrame())
+    if (auto* frame = WebProcess::singleton().webFrame(frameID); frame && frame->coreFrame())
         WebCore::sendCOEPCORPViolation(*frame->coreFrame(), embedderOrigin, endpoint, disposition, destination, blockedURL);
 }
@@ -4339 +4339 @@
         return;
 
-    if (auto* frame = WebProcess::singleton().webFrame(frameID); frame->coreFrame())
+    if (auto* frame = WebProcess::singleton().webFrame(frameID); frame && frame->coreFrame())
         WebCore::sendViolationReportWhenNavigatingToCOOPResponse(*frame->coreFrame(), coop, disposition, coopURL, previousResponseURL, coopOrigin.securityOrigin(), previousResponseOrigin.securityOrigin(), referrer, userAgent);
 }
@@ -4349 +4349 @@
         return;
 
-    if (auto* frame = WebProcess::singleton().webFrame(frameID); frame->coreFrame())
+    if (auto* frame = WebProcess::singleton().webFrame(frameID); frame && frame->coreFrame())
         WebCore::sendViolationReportWhenNavigatingAwayFromCOOPResponse(*frame->coreFrame(), coop, disposition, coopURL, nextResponseURL, coopOrigin.securityOrigin(), nextResponseOrigin.securityOrigin(), isCOOPResponseNavigationSource, userAgent);
 }