Changeset 264880 in webkit

Timestamp:

Jul 24, 2020, 8:10:18 PM (5 years ago)

Author:

achristensen@apple.com

Message:

Null check frame in Document::dispatchDisabledAdaptationsDidChangeForMainFrame and a few other places
​https://bugs.webkit.org/show_bug.cgi?id=214715
<rdar://problem/65467702>

Reviewed by Geoffrey Garen.

Source/WebCore:

Test: security/mutation-observer-frame-detach.html

• dom/Document.cpp:

(WebCore::Document::didBecomeCurrentDocumentInFrame):
(WebCore::Document::initContentSecurityPolicy):

• loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::commitData):
Add some null checks and early returns if the frame detaches.

• loader/SubframeLoader.cpp:

(WebCore::FrameLoader::SubframeLoader::loadSubframe):
Balance the call to incrementLoadEventDelayCount in the early return case or this test never finishes loading.

LayoutTests:

• security/mutation-observer-frame-detach-expected.txt: Added.
• security/mutation-observer-frame-detach.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/security/mutation-observer-frame-detach-expected.txt (added)
• LayoutTests/security/mutation-observer-frame-detach.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/Document.cpp (modified) (3 diffs)
• Source/WebCore/loader/DocumentLoader.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2020-07-24  Alex Christensen  <achristensen@webkit.org>
+
+        Null check frame in Document::dispatchDisabledAdaptationsDidChangeForMainFrame and a few other places
+        https://bugs.webkit.org/show_bug.cgi?id=214715
+        <rdar://problem/65467702>
+
+        Reviewed by Geoffrey Garen.
+
+        * security/mutation-observer-frame-detach-expected.txt: Added.
+        * security/mutation-observer-frame-detach.html: Added.
+
 2020-07-24  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-07-24  Alex Christensen  <achristensen@webkit.org>
+
+        Null check frame in Document::dispatchDisabledAdaptationsDidChangeForMainFrame and a few other places
+        https://bugs.webkit.org/show_bug.cgi?id=214715
+        <rdar://problem/65467702>
+
+        Reviewed by Geoffrey Garen.
+
+        Test: security/mutation-observer-frame-detach.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::didBecomeCurrentDocumentInFrame):
+        (WebCore::Document::initContentSecurityPolicy):
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::commitData):
+        Add some null checks and early returns if the frame detaches.
+        * loader/SubframeLoader.cpp:
+        (WebCore::FrameLoader::SubframeLoader::loadSubframe):
+        Balance the call to incrementLoadEventDelayCount in the early return case or this test never finishes loading.
+
 2020-07-24  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebCore/dom/Document.cpp

@@ -2387 +2387 @@
 void Document::didBecomeCurrentDocumentInFrame()
 {
-    // FIXME: Are there cases where the document can be dislodged from the frame during the event handling below?
-    // If so, then m_frame could become 0, and we need to do something about that.
-
     m_frame->script().updateDocument();
+
+    // Many of these functions have event handlers which can detach the frame synchronously, so we must check repeatedly in this function.
+    if (!m_frame)
+        return;
 
     if (!hasLivingRenderTree())
         createRenderTree();
+    if (!m_frame)
+        return;
 
     dispatchDisabledAdaptationsDidChangeForMainFrame();
+    if (!m_frame)
+        return;
+
     updateViewportArguments();
+    if (!m_frame)
+        return;
 
     // FIXME: Doing this only for the main frame is insufficient.
@@ -2407 +2415 @@
     if (page() && m_frame->isMainFrame())
         wheelEventHandlersChanged();
+    if (!m_frame)
+        return;
 
     // Ensure that the scheduled task state of the document matches the DOM suspension state of the frame. It can
@@ -6099 +6109 @@
 void Document::initContentSecurityPolicy()
 {
+    if (!m_frame)
+        return;
     auto* parentFrame = m_frame->tree().parent();
     if (parentFrame)

trunk/Source/WebCore/loader/DocumentLoader.cpp

@@ -1088 +1088 @@
         m_writer.setDocumentWasLoadedAsPartOfNavigation();
 
-        auto& document = *m_frame->document();
+        auto* documentOrNull = m_frame ? m_frame->document() : nullptr;
+        if (!documentOrNull)
+            return;
+        auto& document = *documentOrNull;
 
         if (SecurityPolicy::allowSubstituteDataAccessToLocal() && m_originalSubstituteDataWasValid) {