Changeset 163628 in webkit

Timestamp:

Feb 7, 2014 10:31:29 AM (10 years ago)

Author:

mitz@apple.com

Message:

[Cocoa] WKWebProcessPlugInNodeHandle methods leak and may crash
​https://bugs.webkit.org/show_bug.cgi?id=128365

Reviewed by Anders Carlsson.

• WebProcess/InjectedBundle/API/Cocoa/WKWebProcessPlugInNodeHandle.mm:

(+[WKWebProcessPlugInNodeHandle nodeHandleWithJSValue:inContext:]): Null-check the result
of InjectedBundleNodeHandle::getOrCreate, and autorelease the return value.
(-[WKWebProcessPlugInNodeHandle htmlIFrameElementContentFrame]): Null-check the result of
InjectedBundleNodeHandle::htmlIFrameElementContentFrame, and autorelease the return value.

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/InjectedBundle/API/Cocoa/WKWebProcessPlugInNodeHandle.mm (modified) (2 diffs)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2014-02-07  Dan Bernstein  <mitz@apple.com>
+
+        [Cocoa] WKWebProcessPlugInNodeHandle methods leak and may crash
+        https://bugs.webkit.org/show_bug.cgi?id=128365
+
+        Reviewed by Anders Carlsson.
+
+        * WebProcess/InjectedBundle/API/Cocoa/WKWebProcessPlugInNodeHandle.mm:
+        (+[WKWebProcessPlugInNodeHandle nodeHandleWithJSValue:inContext:]): Null-check the result
+        of InjectedBundleNodeHandle::getOrCreate, and autorelease the return value.
+        (-[WKWebProcessPlugInNodeHandle htmlIFrameElementContentFrame]): Null-check the result of
+        InjectedBundleNodeHandle::htmlIFrameElementContentFrame, and autorelease the return value.
+
 2014-02-06  Brady Eidson  <beidson@apple.com>
 

trunk/Source/WebKit2/WebProcess/InjectedBundle/API/Cocoa/WKWebProcessPlugInNodeHandle.mm

@@ -49 +49 @@
     JSObjectRef objectRef = JSValueToObject(contextRef, [value JSValueRef], 0);
     RefPtr<InjectedBundleNodeHandle> nodeHandle = InjectedBundleNodeHandle::getOrCreate(contextRef, objectRef);
+    if (!nodeHandle)
+        return nil;
 
-    return wrapper(*nodeHandle.release().leakRef());
+    return [wrapper(*nodeHandle.release().leakRef()) autorelease];
 }
 
@@ -56 +58 @@
 {
     RefPtr<WebFrame> frame = _nodeHandle->htmlIFrameElementContentFrame();
-    return wrapper(*frame.release().leakRef());
+    if (!frame)
+        return nil;
+
+    return [wrapper(*frame.release().leakRef()) autorelease];
 }