Changeset 151812 in webkit

Timestamp:

Jun 20, 2013, 5:44:38 PM (12 years ago)

Author:

ap@apple.com

Message:

​https://bugs.webkit.org/show_bug.cgi?id=116495
Fix null-pointer deref in DocumentLoader::responseReceived()

Patch by Nate Chapin, reviewed by Mike West and myself.

Test: http/tests/security/XFrameOptions/x-frame-options-deny-delete-frame-in-load-event.html

• loader/DocumentLoader.cpp: (WebCore::DocumentLoader::responseReceived): Added a null check.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-delete-frame-in-load-event-expected.txt (added)
• LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-delete-frame-in-load-event.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/loader/DocumentLoader.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-06-20  Alexey Proskuryakov  <ap@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=116495
+        Fix null-pointer deref in DocumentLoader::responseReceived()
+
+        Patch by Nate Chapin, reviewed by Mike West and myself.
+
+        * http/tests/security/XFrameOptions/x-frame-options-deny-delete-frame-in-load-event-expected.txt: Added.
+        * http/tests/security/XFrameOptions/x-frame-options-deny-delete-frame-in-load-event.html: Added.
+
 2013-06-20  Enrica Casucci  <enrica@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-06-20  Alexey Proskuryakov  <ap@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=116495
+        Fix null-pointer deref in DocumentLoader::responseReceived()
+
+        Patch by Nate Chapin, reviewed by Mike West and myself.
+
+        Test: http/tests/security/XFrameOptions/x-frame-options-deny-delete-frame-in-load-event.html
+
+        * loader/DocumentLoader.cpp: (WebCore::DocumentLoader::responseReceived): Added
+        a null check.
+
 2013-06-20  Roger Fong  <roger_fong@apple.com>
 

trunk/Source/WebCore/loader/DocumentLoader.cpp

@@ -582 +582 @@
             if (HTMLFrameOwnerElement* ownerElement = frame()->ownerElement())
                 ownerElement->dispatchEvent(Event::create(eventNames().loadEvent, false, false));
-            cancelMainResourceLoad(frameLoader()->cancelledError(m_request));
+
+            // The load event might have detached this frame. In that case, the load will already have been cancelled during detach.
+            if (frameLoader())
+                cancelMainResourceLoad(frameLoader()->cancelledError(m_request));
             return;
         }