Changeset 253006 in webkit

Timestamp:

Dec 2, 2019 12:32:54 PM (4 years ago)

Author:

ysuzuki@apple.com

Message:

Document::setWindowAttributeEventListener should check m_domWindow::frame()
​https://bugs.webkit.org/show_bug.cgi?id=204759
<rdar://problem/50098787>

Reviewed by Mark Lam.

JSLazyEventListener::create assumes that m_domWindow::frame() exists.
But this check was removed at r196888 accidentally.
This patch adds this check back to fix the crash.

• dom/Document.cpp:

(WebCore::Document::setWindowAttributeEventListener):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• dom/Document.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-12-02  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        Document::setWindowAttributeEventListener should check `m_domWindow::frame()`
+        https://bugs.webkit.org/show_bug.cgi?id=204759
+        <rdar://problem/50098787>
+
+        Reviewed by Mark Lam.
+
+        JSLazyEventListener::create assumes that `m_domWindow::frame()` exists.
+        But this check was removed at r196888 accidentally.
+        This patch adds this check back to fix the crash.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setWindowAttributeEventListener):
+
 2019-12-02  Zalan Bujtas  <zalan@apple.com>
 

trunk/Source/WebCore/dom/Document.cpp

@@ -4691 +4691 @@
     if (!m_domWindow)
         return;
+    if (!m_domWindow->frame())
+        return;
     setWindowAttributeEventListener(eventType, JSLazyEventListener::create(*m_domWindow, attributeName, attributeValue), isolatedWorld);
 }