⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 287814 in webkit


Ignore:
Timestamp:
Jan 8, 2022, 2:12:16 PM (5 years ago)
Author:
Wenson Hsieh
Message:

Null pointer crash when calling into -[WebView close] in -webView:didCommitLoadForFrame:
​https://bugs.webkit.org/show_bug.cgi?id=234994
rdar://86845512

Reviewed by Chris Dumez and Geoff Garen.

Source/WebCore:

Add a null check in FrameLoader::dispatchDidCommitLoad() before calling into any methods on the frame's Page.
Since we called into the client layer to dispatchDidCommitLoad() immediately prior to this, a legacy WebKit
client may have already caused the page to be destroyed (e.g. by closing the web view). Since Frame's pointer
to Page is a WeakPtr, this triggers null derefs when attempting to call either didCommitLoad() or
remoteInspectorInformationDidChange().

Test: WebKitLegacy.CloseWhileCommittingLoad

  • loader/FrameLoader.cpp:

(WebCore::FrameLoader::dispatchDidCommitLoad):

Tools:

Add a new API test to exercise the fix.

  • TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
  • TestWebKitAPI/Tests/WebKitCocoa/CloseWhileCommittingLoad.mm: Added.

(-[CloseWhileCommittingLoadDelegate webView:didCommitLoadForFrame:]):
(TestWebKitAPI::TEST):

Location:
trunk
Files:
1 added
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebCore/ChangeLog

    r287812 r287814  
     12022-01-08  Wenson Hsieh  <wenson_hsieh@apple.com>
     2
     3        Null pointer crash when calling into `-[WebView close]` in `-webView:didCommitLoadForFrame:`
     4        https://bugs.webkit.org/show_bug.cgi?id=234994
     5        rdar://86845512
     6
     7        Reviewed by Chris Dumez and Geoff Garen.
     8
     9        Add a null check in `FrameLoader::dispatchDidCommitLoad()` before calling into any methods on the frame's Page.
     10        Since we called into the client layer to `dispatchDidCommitLoad()` immediately prior to this, a legacy WebKit
     11        client may have already caused the page to be destroyed (e.g. by closing the web view). Since Frame's pointer
     12        to Page is a WeakPtr, this triggers null derefs when attempting to call either `didCommitLoad()` or
     13        `remoteInspectorInformationDidChange()`.
     14
     15        Test: WebKitLegacy.CloseWhileCommittingLoad
     16
     17        * loader/FrameLoader.cpp:
     18        (WebCore::FrameLoader::dispatchDidCommitLoad):
     19
    1202022-01-08  Gabriel Nava Marino  <gnavamarino@apple.com>
    221

  • trunk/Source/WebCore/loader/FrameLoader.cpp

    r287731 r287814  
    40404040    m_client->dispatchDidCommitLoad(initialHasInsecureContent, initialUsedLegacyTLS);
    40414041
    4042     if (m_frame.isMainFrame())
    4043         m_frame.page()->didCommitLoad();
     4042    if (auto* page = m_frame.page(); page && m_frame.isMainFrame())
     4043        page->didCommitLoad();
    40444044
    40454045    InspectorInstrumentation::didCommitLoad(m_frame, m_documentLoader.get());
    40464046
    40474047#if ENABLE(REMOTE_INSPECTOR)
    4048     if (m_frame.isMainFrame())
    4049         m_frame.page()->remoteInspectorInformationDidChange();
     4048    if (auto* page = m_frame.page(); page && m_frame.isMainFrame())
     4049        page->remoteInspectorInformationDidChange();
    40504050#endif
    40514051}

  • trunk/Tools/ChangeLog

    r287810 r287814  
     12022-01-08  Wenson Hsieh  <wenson_hsieh@apple.com>
     2
     3        Null pointer crash when calling into `-[WebView close]` in `-webView:didCommitLoadForFrame:`
     4        https://bugs.webkit.org/show_bug.cgi?id=234994
     5        rdar://86845512
     6
     7        Reviewed by Chris Dumez and Geoff Garen.
     8
     9        Add a new API test to exercise the fix.
     10
     11        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
     12        * TestWebKitAPI/Tests/WebKitCocoa/CloseWhileCommittingLoad.mm: Added.
     13        (-[CloseWhileCommittingLoadDelegate webView:didCommitLoadForFrame:]):
     14        (TestWebKitAPI::TEST):
     15
    1162022-01-08  Tyler Wilcock  <tyler_w@apple.com>
    217

  • trunk/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj

    r287671 r287814  
    10301030                F434CA1A22E65BCA005DDB26 /* ScrollToRevealSelection.mm in Sources */ = {isa = PBXBuildFile; fileRef = F434CA1922E65BCA005DDB26 /* ScrollToRevealSelection.mm */; };
    10311031                F4352F9F26D403DE00E605E4 /* editable-responsive-body.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = F4352F9E26D4037000E605E4 /* editable-responsive-body.html */; };
     1032                F43CAB1D278A326500C8D0A2 /* CloseWhileCommittingLoad.mm in Sources */ = {isa = PBXBuildFile; fileRef = F43CAB1C278A326500C8D0A2 /* CloseWhileCommittingLoad.mm */; };
    10321033                F43E3BBF20DADA1E00A4E7ED /* WKScrollViewTests.mm in Sources */ = {isa = PBXBuildFile; fileRef = F43E3BBE20DADA1E00A4E7ED /* WKScrollViewTests.mm */; };
    10331034                F43E3BC120DADBC500A4E7ED /* fixed-nav-bar.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = F43E3BC020DADB8000A4E7ED /* fixed-nav-bar.html */; };
    … …  
    29812982                F4352F9E26D4037000E605E4 /* editable-responsive-body.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = "editable-responsive-body.html"; sourceTree = "<group>"; };
    29822983                F43C3823278133190099ABCE /* NSResponderTests.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; path = NSResponderTests.mm; sourceTree = "<group>"; };
     2984                F43CAB1C278A326500C8D0A2 /* CloseWhileCommittingLoad.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = CloseWhileCommittingLoad.mm; sourceTree = "<group>"; };
    29832985                F43E3BBE20DADA1E00A4E7ED /* WKScrollViewTests.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; path = WKScrollViewTests.mm; sourceTree = "<group>"; };
    29842986                F43E3BC020DADB8000A4E7ED /* fixed-nav-bar.html */ = {isa = PBXFileReference; lastKnownFileType = text.html; path = "fixed-nav-bar.html"; sourceTree = "<group>"; };
    … …  
    30803082                F4D65DA71F5E46C0009D8C27 /* selected-text-image-link-and-editable.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = "selected-text-image-link-and-editable.html"; sourceTree = "<group>"; };
    30813083                F4D9818E2196B911008230FC /* editable-nested-lists.html */ = {isa = PBXFileReference; lastKnownFileType = text.html; path = "editable-nested-lists.html"; sourceTree = "<group>"; };
     3084                F4DBE5DC278906A300642BC0 /* CloseWhileCommittingLoad.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; path = CloseWhileCommittingLoad.mm; sourceTree = "<group>"; };
    30823085                F4DEF6EC1E9B4D950048EF61 /* image-in-link-and-input.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = "image-in-link-and-input.html"; sourceTree = "<group>"; };
    30833086                F4E0A28E211E5D5B00AF7C7F /* DragAndDropTestsMac.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; path = DragAndDropTestsMac.mm; sourceTree = "<group>"; };
    … …  
    33963399                                CDF92236216D186400647AA7 /* CloseWebViewAfterEnterFullscreen.mm */,
    33973400                                CDF0B789216D484300421ECC /* CloseWebViewDuringEnterFullscreen.mm */,
     3401                                F4DBE5DC278906A300642BC0 /* CloseWhileCommittingLoad.mm */,
    33983402                                1AAD19F51C7CE20300831E47 /* Coding.mm */,
    33993403                                7C3DB8E21D12129B00AE8CC3 /* CommandBackForward.mm */,
    … …  
    47814785                                93CFA8681CEBCFED000565A8 /* CandidateTests.mm */,
    47824786                                290A9BB51735DE8A00D71BBC /* CloseNewWindowInNavigationPolicyDelegate.mm */,
     4787                                F43CAB1C278A326500C8D0A2 /* CloseWhileCommittingLoad.mm */,
    47834788                                A1146A8A1D2D704F000FE710 /* ContentFiltering.mm */,
    47844789                                5142B2701517C88B00C32B19 /* ContextMenuCanCopyURL.mm */,
    … …  
    54435448                                7CCE7EB71A411A7E00447C4C /* CloseNewWindowInNavigationPolicyDelegate.mm in Sources */,
    54445449                                7CCE7EE51A411AE600447C4C /* CloseThenTerminate.cpp in Sources */,
     5450                                F43CAB1D278A326500C8D0A2 /* CloseWhileCommittingLoad.mm in Sources */,
    54455451                                6B306106218A372900F5A802 /* ClosingWebView.mm in Sources */,
    54465452                                7C3965061CDD74F90094DBB8 /* ColorTests.cpp in Sources */,
Note: See TracChangeset for help on using the changeset viewer.