⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 287850 in webkit


Ignore:
Timestamp:
Jan 10, 2022, 12:09:53 PM (5 years ago)
Author:
Alan Coon
Message:

Cherry-pick r287814. rdar://problem/86845512

Null pointer crash when calling into -[WebView close] in -webView:didCommitLoadForFrame:
​https://bugs.webkit.org/show_bug.cgi?id=234994
rdar://86845512

Reviewed by Chris Dumez and Geoff Garen.

Source/WebCore:

Add a null check in FrameLoader::dispatchDidCommitLoad() before calling into any methods on the frame's Page.
Since we called into the client layer to dispatchDidCommitLoad() immediately prior to this, a legacy WebKit
client may have already caused the page to be destroyed (e.g. by closing the web view). Since Frame's pointer
to Page is a WeakPtr, this triggers null derefs when attempting to call either didCommitLoad() or
remoteInspectorInformationDidChange().

Test: WebKitLegacy.CloseWhileCommittingLoad

  • loader/FrameLoader.cpp: (WebCore::FrameLoader::dispatchDidCommitLoad):

Tools:

Add a new API test to exercise the fix.

  • TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
  • TestWebKitAPI/Tests/WebKitCocoa/CloseWhileCommittingLoad.mm: Added. (-[CloseWhileCommittingLoadDelegate webView:didCommitLoadForFrame:]): (TestWebKitAPI::TEST):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@287814 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-612.4.9.1-branch
Files:
1 added
4 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-612.4.9.1-branch/Source/WebCore/ChangeLog

    r287791 r287850  
     12022-01-10  Russell Epstein  <repstein@apple.com>
     2
     3        Cherry-pick r287814. rdar://problem/86845512
     4
     5    Null pointer crash when calling into `-[WebView close]` in `-webView:didCommitLoadForFrame:`
     6    https://bugs.webkit.org/show_bug.cgi?id=234994
     7    rdar://86845512
     8   
     9    Reviewed by Chris Dumez and Geoff Garen.
     10   
     11    Source/WebCore:
     12   
     13    Add a null check in `FrameLoader::dispatchDidCommitLoad()` before calling into any methods on the frame's Page.
     14    Since we called into the client layer to `dispatchDidCommitLoad()` immediately prior to this, a legacy WebKit
     15    client may have already caused the page to be destroyed (e.g. by closing the web view). Since Frame's pointer
     16    to Page is a WeakPtr, this triggers null derefs when attempting to call either `didCommitLoad()` or
     17    `remoteInspectorInformationDidChange()`.
     18   
     19    Test: WebKitLegacy.CloseWhileCommittingLoad
     20   
     21    * loader/FrameLoader.cpp:
     22    (WebCore::FrameLoader::dispatchDidCommitLoad):
     23   
     24    Tools:
     25   
     26    Add a new API test to exercise the fix.
     27   
     28    * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
     29    * TestWebKitAPI/Tests/WebKitCocoa/CloseWhileCommittingLoad.mm: Added.
     30    (-[CloseWhileCommittingLoadDelegate webView:didCommitLoadForFrame:]):
     31    (TestWebKitAPI::TEST):
     32   
     33    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@287814 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     34
     35    2022-01-08  Wenson Hsieh  <wenson_hsieh@apple.com>
     36
     37            Null pointer crash when calling into `-[WebView close]` in `-webView:didCommitLoadForFrame:`
     38            https://bugs.webkit.org/show_bug.cgi?id=234994
     39            rdar://86845512
     40
     41            Reviewed by Chris Dumez and Geoff Garen.
     42
     43            Add a null check in `FrameLoader::dispatchDidCommitLoad()` before calling into any methods on the frame's Page.
     44            Since we called into the client layer to `dispatchDidCommitLoad()` immediately prior to this, a legacy WebKit
     45            client may have already caused the page to be destroyed (e.g. by closing the web view). Since Frame's pointer
     46            to Page is a WeakPtr, this triggers null derefs when attempting to call either `didCommitLoad()` or
     47            `remoteInspectorInformationDidChange()`.
     48
     49            Test: WebKitLegacy.CloseWhileCommittingLoad
     50
     51            * loader/FrameLoader.cpp:
     52            (WebCore::FrameLoader::dispatchDidCommitLoad):
     53
    1542022-01-07  Russell Epstein  <repstein@apple.com>
    255

  • branches/safari-612.4.9.1-branch/Source/WebCore/loader/FrameLoader.cpp

    r287680 r287850  
    40334033    m_client->dispatchDidCommitLoad(initialHasInsecureContent, initialUsedLegacyTLS);
    40344034
    4035     if (m_frame.isMainFrame())
    4036         m_frame.page()->didCommitLoad();
     4035    if (auto* page = m_frame.page(); page && m_frame.isMainFrame())
     4036        page->didCommitLoad();
    40374037
    40384038    InspectorInstrumentation::didCommitLoad(m_frame, m_documentLoader.get());
    40394039
    40404040#if ENABLE(REMOTE_INSPECTOR)
    4041     if (m_frame.isMainFrame())
    4042         m_frame.page()->remoteInspectorInformationDidChange();
     4041    if (auto* page = m_frame.page(); page && m_frame.isMainFrame())
     4042        page->remoteInspectorInformationDidChange();
    40434043#endif
    40444044}

  • branches/safari-612.4.9.1-branch/Tools/ChangeLog

    r287628 r287850  
     12022-01-10  Russell Epstein  <repstein@apple.com>
     2
     3        Cherry-pick r287814. rdar://problem/86845512
     4
     5    Null pointer crash when calling into `-[WebView close]` in `-webView:didCommitLoadForFrame:`
     6    https://bugs.webkit.org/show_bug.cgi?id=234994
     7    rdar://86845512
     8   
     9    Reviewed by Chris Dumez and Geoff Garen.
     10   
     11    Source/WebCore:
     12   
     13    Add a null check in `FrameLoader::dispatchDidCommitLoad()` before calling into any methods on the frame's Page.
     14    Since we called into the client layer to `dispatchDidCommitLoad()` immediately prior to this, a legacy WebKit
     15    client may have already caused the page to be destroyed (e.g. by closing the web view). Since Frame's pointer
     16    to Page is a WeakPtr, this triggers null derefs when attempting to call either `didCommitLoad()` or
     17    `remoteInspectorInformationDidChange()`.
     18   
     19    Test: WebKitLegacy.CloseWhileCommittingLoad
     20   
     21    * loader/FrameLoader.cpp:
     22    (WebCore::FrameLoader::dispatchDidCommitLoad):
     23   
     24    Tools:
     25   
     26    Add a new API test to exercise the fix.
     27   
     28    * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
     29    * TestWebKitAPI/Tests/WebKitCocoa/CloseWhileCommittingLoad.mm: Added.
     30    (-[CloseWhileCommittingLoadDelegate webView:didCommitLoadForFrame:]):
     31    (TestWebKitAPI::TEST):
     32   
     33    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@287814 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     34
     35    2022-01-08  Wenson Hsieh  <wenson_hsieh@apple.com>
     36
     37            Null pointer crash when calling into `-[WebView close]` in `-webView:didCommitLoadForFrame:`
     38            https://bugs.webkit.org/show_bug.cgi?id=234994
     39            rdar://86845512
     40
     41            Reviewed by Chris Dumez and Geoff Garen.
     42
     43            Add a new API test to exercise the fix.
     44
     45            * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
     46            * TestWebKitAPI/Tests/WebKitCocoa/CloseWhileCommittingLoad.mm: Added.
     47            (-[CloseWhileCommittingLoadDelegate webView:didCommitLoadForFrame:]):
     48            (TestWebKitAPI::TEST):
     49
    1502022-01-05  Russell Epstein  <repstein@apple.com>
    251

  • branches/safari-612.4.9.1-branch/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj

    r285598 r287850  
    12001200                F42DA5161D8CEFE400336F40 /* large-input-field-focus-onload.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = F42DA5151D8CEFDB00336F40 /* large-input-field-focus-onload.html */; };
    12011201                F434CA1A22E65BCA005DDB26 /* ScrollToRevealSelection.mm in Sources */ = {isa = PBXBuildFile; fileRef = F434CA1922E65BCA005DDB26 /* ScrollToRevealSelection.mm */; };
     1202                F43CAB1D278A326500C8D0A2 /* CloseWhileCommittingLoad.mm in Sources */ = {isa = PBXBuildFile; fileRef = F43CAB1C278A326500C8D0A2 /* CloseWhileCommittingLoad.mm */; };
    12021203                F43E3BBF20DADA1E00A4E7ED /* WKScrollViewTests.mm in Sources */ = {isa = PBXBuildFile; fileRef = F43E3BBE20DADA1E00A4E7ED /* WKScrollViewTests.mm */; };
    12031204                F43E3BC120DADBC500A4E7ED /* fixed-nav-bar.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = F43E3BC020DADB8000A4E7ED /* fixed-nav-bar.html */; };
    … …  
    30473048                F42DA5151D8CEFDB00336F40 /* large-input-field-focus-onload.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; name = "large-input-field-focus-onload.html"; path = "Tests/WebKitCocoa/large-input-field-focus-onload.html"; sourceTree = SOURCE_ROOT; };
    30483049                F434CA1922E65BCA005DDB26 /* ScrollToRevealSelection.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; path = ScrollToRevealSelection.mm; sourceTree = "<group>"; };
     3050                F43CAB1C278A326500C8D0A2 /* CloseWhileCommittingLoad.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = CloseWhileCommittingLoad.mm; sourceTree = "<group>"; };
    30493051                F43E3BBE20DADA1E00A4E7ED /* WKScrollViewTests.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; path = WKScrollViewTests.mm; sourceTree = "<group>"; };
    30503052                F43E3BC020DADB8000A4E7ED /* fixed-nav-bar.html */ = {isa = PBXFileReference; lastKnownFileType = text.html; path = "fixed-nav-bar.html"; sourceTree = "<group>"; };
    … …  
    31413143                F4D65DA71F5E46C0009D8C27 /* selected-text-image-link-and-editable.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = "selected-text-image-link-and-editable.html"; sourceTree = "<group>"; };
    31423144                F4D9818E2196B911008230FC /* editable-nested-lists.html */ = {isa = PBXFileReference; lastKnownFileType = text.html; path = "editable-nested-lists.html"; sourceTree = "<group>"; };
     3145                F4DBE5DC278906A300642BC0 /* CloseWhileCommittingLoad.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; path = CloseWhileCommittingLoad.mm; sourceTree = "<group>"; };
    31433146                F4DEF6EC1E9B4D950048EF61 /* image-in-link-and-input.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = "image-in-link-and-input.html"; sourceTree = "<group>"; };
    31443147                F4E0A28E211E5D5B00AF7C7F /* DragAndDropTestsMac.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; path = DragAndDropTestsMac.mm; sourceTree = "<group>"; };
    … …  
    34433446                                CDF92236216D186400647AA7 /* CloseWebViewAfterEnterFullscreen.mm */,
    34443447                                CDF0B789216D484300421ECC /* CloseWebViewDuringEnterFullscreen.mm */,
     3448                                F4DBE5DC278906A300642BC0 /* CloseWhileCommittingLoad.mm */,
    34453449                                1AAD19F51C7CE20300831E47 /* Coding.mm */,
    34463450                                7C3DB8E21D12129B00AE8CC3 /* CommandBackForward.mm */,
    … …  
    47544758                                93CFA8681CEBCFED000565A8 /* CandidateTests.mm */,
    47554759                                290A9BB51735DE8A00D71BBC /* CloseNewWindowInNavigationPolicyDelegate.mm */,
     4760                                F43CAB1C278A326500C8D0A2 /* CloseWhileCommittingLoad.mm */,
    47564761                                A1146A8A1D2D704F000FE710 /* ContentFiltering.mm */,
    47574762                                5142B2701517C88B00C32B19 /* ContextMenuCanCopyURL.mm */,
    … …  
    54315436                                CDF92237216D186400647AA7 /* CloseWebViewAfterEnterFullscreen.mm in Sources */,
    54325437                                CDF0B78A216D48DC00421ECC /* CloseWebViewDuringEnterFullscreen.mm in Sources */,
     5438                                F43CAB1D278A326500C8D0A2 /* CloseWhileCommittingLoad.mm in Sources */,
    54335439                                6B306106218A372900F5A802 /* ClosingWebView.mm in Sources */,
    54345440                                7C83E0BA1D0A64FB00FEBCF3 /* Coding.mm in Sources */,
Note: See TracChangeset for help on using the changeset viewer.