Changeset 293819 in webkit

Timestamp:

May 4, 2022 9:45:27 PM (2 years ago)

Author:

commit-queue@webkit.org

Message:

Crash in WindowProxy::setDOMWindow
​https://bugs.webkit.org/show_bug.cgi?id=232763

Patch by Alex Christensen <​achristensen@webkit.org> on 2022-05-04
Reviewed by Chris Dumez.

Source/WebCore:

Add a few null checks here and there.

Test: fast/dom/set-dom-window-without-page.html

• bindings/js/WindowProxy.cpp:

(WebCore::WindowProxy::setDOMWindow):

• loader/FrameLoader.cpp:

(WebCore::FrameLoader::findFrameForNavigation):

LayoutTests:

• fast/dom/set-dom-window-without-page-expected.txt: Added.
• fast/dom/set-dom-window-without-page.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/set-dom-window-without-page-expected.txt (added)
• LayoutTests/fast/dom/set-dom-window-without-page.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/bindings/js/WindowProxy.cpp (modified) (1 diff)
• Source/WebCore/loader/FrameLoader.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2022-05-04  Alex Christensen  <achristensen@webkit.org>
+
+        Crash in WindowProxy::setDOMWindow
+        https://bugs.webkit.org/show_bug.cgi?id=232763
+
+        Reviewed by Chris Dumez.
+
+        * fast/dom/set-dom-window-without-page-expected.txt: Added.
+        * fast/dom/set-dom-window-without-page.html: Added.
+
 2022-05-04  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2022-05-04  Alex Christensen  <achristensen@webkit.org>
+
+        Crash in WindowProxy::setDOMWindow
+        https://bugs.webkit.org/show_bug.cgi?id=232763
+
+        Reviewed by Chris Dumez.
+
+        Add a few null checks here and there.
+
+        Test: fast/dom/set-dom-window-without-page.html
+
+        * bindings/js/WindowProxy.cpp:
+        (WebCore::WindowProxy::setDOMWindow):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::findFrameForNavigation):
+
 2022-05-04  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebCore/bindings/js/WindowProxy.cpp

@@ -187 +187 @@
 
         windowProxy->attachDebugger(page ? page->debugger() : nullptr);
-        if (page)
+        if (page) {
             windowProxy->window()->setProfileGroup(page->group().identifier());
-        windowProxy->window()->setConsoleClient(page->console());
+            windowProxy->window()->setConsoleClient(page->console());
+        }
     }
 }

trunk/Source/WebCore/loader/FrameLoader.cpp

@@ -3745 +3745 @@
         activeDocument = m_frame.document();
 
+    if (!activeDocument)
+        return nullptr;
+
     auto* frame = m_frame.tree().find(name, activeDocument->frame() ? *activeDocument->frame() : m_frame);