Changeset 287017 in webkit

Timestamp:

Dec 14, 2021, 1:35:38 AM (5 years ago)

Author:

youenn@apple.com

Message:

Null pointer crash in FetchResponse::clone
​https://bugs.webkit.org/show_bug.cgi?id=234236
<rdar://86327601>

Reviewed by Alex Christensen.

From the log, we are most probably getting a null globalObject from a ScriptExecutionContext in FetchResponse::clone.
This may happen in case the document is navigated away but we still execute some code for it.
Add a null check to ensure we do not crash.

• Modules/fetch/FetchResponse.cpp:

(WebCore::FetchResponse::clone):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/fetch/FetchResponse.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-12-14  Youenn Fablet  <youenn@apple.com>
+
+        Null pointer crash in FetchResponse::clone
+        https://bugs.webkit.org/show_bug.cgi?id=234236
+        <rdar://86327601>
+
+        Reviewed by Alex Christensen.
+
+        From the log, we are most probably getting a null globalObject from a ScriptExecutionContext in FetchResponse::clone.
+        This may happen in case the document is navigated away but we still execute some code for it.
+        Add a null check to ensure we do not crash.
+
+        * Modules/fetch/FetchResponse.cpp:
+        (WebCore::FetchResponse::clone):
+
 2021-12-14  Ben Nham  <nham@apple.com>
 

trunk/Source/WebCore/Modules/fetch/FetchResponse.cpp

@@ -183 +183 @@
     // If loading, let's create a stream so that data is teed on both clones.
     if (isLoading() && !m_readableStreamSource) {
-        auto voidOrException = createReadableStream(*context.globalObject());
+        auto* globalObject = context.globalObject();
+        if (!globalObject)
+            return Exception { InvalidStateError, "Context is stopped"_s };
+
+        auto voidOrException = createReadableStream(*globalObject);
         if (UNLIKELY(voidOrException.hasException()))
             return voidOrException.releaseException();