Changeset 275474 in webkit

Timestamp:

Apr 5, 2021 7:12:48 PM (3 years ago)

Author:

Chris Dumez

Message:

Protect frame in WebPage::runJavaScriptInFrameInScriptWorld()
​https://bugs.webkit.org/show_bug.cgi?id=224210

Reviewed by Alex Christensen.

Between the time we were getting the raw pointer to the frame, and the time were were passing it to
WebPage::runJavaScript(), we were potentially calling WebFrameLoaderClient::dispatchGlobalObjectAvailable().
It is possible in theory for those synchronous injected bundle calls to mess with the frame tree and cause
our frame to go bad. As a result, it is best to protect the frame as soon as we get it.

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::runJavaScriptInFrameInScriptWorld):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/WebPage/WebPage.cpp (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-04-05  Chris Dumez  <cdumez@apple.com>
+
+        Protect frame in WebPage::runJavaScriptInFrameInScriptWorld()
+        https://bugs.webkit.org/show_bug.cgi?id=224210
+
+        Reviewed by Alex Christensen.
+
+        Between the time we were getting the raw pointer to the frame, and the time were were passing it to
+        WebPage::runJavaScript(), we were potentially calling WebFrameLoaderClient::dispatchGlobalObjectAvailable().
+        It is possible in theory for those synchronous injected bundle calls to mess with the frame tree and cause
+        our frame to go bad. As a result, it is best to protect the frame as soon as we get it.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::runJavaScriptInFrameInScriptWorld):
+
 2021-04-05  Wenson Hsieh  <wenson_hsieh@apple.com>
 

trunk/Source/WebKit/WebProcess/WebPage/WebPage.cpp

@@ -3653 +3653 @@
 void WebPage::runJavaScriptInFrameInScriptWorld(RunJavaScriptParameters&& parameters, Optional<WebCore::FrameIdentifier> frameID, const std::pair<ContentWorldIdentifier, String>& worldData, CompletionHandler<void(const IPC::DataReference&, const Optional<WebCore::ExceptionDetails>&)>&& completionHandler)
 {
-    auto* webFrame = frameID ? WebProcess::singleton().webFrame(*frameID) : &mainWebFrame();
+    auto webFrame = makeRefPtr(frameID ? WebProcess::singleton().webFrame(*frameID) : &mainWebFrame());
 
     if (auto* newWorld = m_userContentController->addContentWorld(worldData)) {
@@ -3661 +3661 @@
     }
 
-    runJavaScript(webFrame, WTFMove(parameters), worldData.first, WTFMove(completionHandler));
+    runJavaScript(webFrame.get(), WTFMove(parameters), worldData.first, WTFMove(completionHandler));
 }