<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>128889</bug_id>
          <alias>CVE-2014-1309</alias>
          <creation_ts>2014-02-16 16:22:46 -0800</creation_ts>
          <short_desc>Ensure that removing an iframe from the DOM tree disconnects its Frame.</short_desc>
          <delta_ts>2016-07-19 13:08:40 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Frames</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Andreas Kling">kling</reporter>
          <assigned_to name="Andreas Kling">kling</assigned_to>
          <cc>chai</cc>
    
    <cc>commit-queue</cc>
    
    <cc>esprehn+autocc</cc>
    
    <cc>gyuyoung.kim</cc>
    
    <cc>kling</cc>
    
    <cc>rniwa</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>981302</commentid>
    <comment_count>0</comment_count>
    <who name="Andreas Kling">kling</who>
    <bug_when>2014-02-16 16:22:46 -0800</bug_when>
    <thetext>Merge https://src.chromium.org/viewvc/blink?revision=156174&amp;view=revision</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>981303</commentid>
    <comment_count>1</comment_count>
    <who name="Andreas Kling">kling</who>
    <bug_when>2014-02-16 16:23:06 -0800</bug_when>
    <thetext>&lt;rdar://problem/15671221&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>981304</commentid>
    <comment_count>2</comment_count>
      <attachid>224325</attachid>
    <who name="Andreas Kling">kling</who>
    <bug_when>2014-02-16 16:25:08 -0800</bug_when>
    <thetext>Created attachment 224325
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>981307</commentid>
    <comment_count>3</comment_count>
      <attachid>224325</attachid>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2014-02-16 17:30:37 -0800</bug_when>
    <thetext>Comment on attachment 224325
Patch

Rejecting attachment 224325 from commit-queue.

Failed to run &quot;[&apos;/Volumes/Data/EWS/WebKit/Tools/Scripts/webkit-patch&apos;, &apos;--status-host=webkit-queues.appspot.com&apos;, &apos;--bot-id=webkit-cq-03&apos;, &apos;validate-changelog&apos;, &apos;--check-oops&apos;, &apos;--non-interactive&apos;, 224325, &apos;--port=mac&apos;]&quot; exit_code: 1 cwd: /Volumes/Data/EWS/WebKit

/Volumes/Data/EWS/WebKit/LayoutTests/ChangeLog neither lists a valid reviewer nor contains the string &quot;Unreviewed&quot; or &quot;Rubber stamp&quot; (case insensitive).

Full output: http://webkit-queues.appspot.com/results/5326877682040832</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>981318</commentid>
    <comment_count>4</comment_count>
    <who name="Andreas Kling">kling</who>
    <bug_when>2014-02-16 19:46:50 -0800</bug_when>
    <thetext>Committed r164204: &lt;http://trac.webkit.org/changeset/164204&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1212478</commentid>
    <comment_count>5</comment_count>
    <who name="Brent Fulgham">bfulgham</who>
    <bug_when>2016-07-19 13:08:40 -0700</bug_when>
    <thetext>*** Bug 120497 has been marked as a duplicate of this bug. ***</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>224325</attachid>
            <date>2014-02-16 16:25:08 -0800</date>
            <delta_ts>2014-02-16 17:30:37 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>bug-128889.diff</filename>
            <type>text/plain</type>
            <size>4158</size>
            <attacher name="Andreas Kling">kling</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv
ZwppbmRleCBiNTExZTE4Li43ODcxMDUxIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VM
b2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTQtMDIt
MTYgIEFuZHJlYXMgS2xpbmcgIDxha2xpbmdAYXBwbGUuY29tPgorCisgICAgICAgIEVuc3VyZSB0
aGF0IHJlbW92aW5nIGFuIGlmcmFtZSBmcm9tIHRoZSBET00gdHJlZSBkaXNjb25uZWN0cyBpdHMg
RnJhbWUuCisgICAgICAgIDxodHRwczovL3dlYmtpdC5vcmcvYi8xMjg4ODk+CisgICAgICAgIDxy
ZGFyOi8vcHJvYmxlbS8xNTY3MTIyMT4KKworICAgICAgICBNZXJnZWQgZnJvbSBCbGluayAocGF0
Y2ggYnkgQWRhbSBLbGVpbik6CisgICAgICAgIGh0dHBzOi8vc3JjLmNocm9taXVtLm9yZy92aWV3
dmMvYmxpbms/cmV2aXNpb249MTU2MTc0JnZpZXc9cmV2aXNpb24KKworICAgICAgICAqIGZhc3Qv
ZnJhbWVzL3JlYXR0YWNoLWluLXVubG9hZC1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAq
IGZhc3QvZnJhbWVzL3JlYXR0YWNoLWluLXVubG9hZC5odG1sOiBBZGRlZC4KKwogMjAxNC0wMi0x
NSAgUGlvdHIgR3JhZCAgPHAuZ3JhZEBzYW1zdW5nLmNvbT4KIAogICAgICAgICBTZXR0aW5nIGN1
cnJlbnRUaW1lIG9uIEhUTUxNZWRpYUVsZW1lbnQgd2l0aCBtZWRpYSBjb250cm9sbGVyIHNob3Vs
ZCB0aHJvdyBleGNlcHRpb24uCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L2ZyYW1lcy9y
ZWF0dGFjaC1pbi11bmxvYWQtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFzdC9mcmFtZXMv
cmVhdHRhY2gtaW4tdW5sb2FkLWV4cGVjdGVkLnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRl
eCAwMDAwMDAwLi43YTA0MTYzCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9m
cmFtZXMvcmVhdHRhY2gtaW4tdW5sb2FkLWV4cGVjdGVkLnR4dApAQCAtMCwwICsxLDEyIEBACitF
bnN1cmUgdGhhdCByZW1vdmluZyBhbiBpZnJhbWUgZnJvbSB0aGUgdHJlZSByZXN1bHRzIGluIGZy
YW1lIGRlc3RydWN0aW9uCisKK09uIHN1Y2Nlc3MsIHlvdSB3aWxsIHNlZSBhIHNlcmllcyBvZiAi
UEFTUyIgbWVzc2FnZXMsIGZvbGxvd2VkIGJ5ICJURVNUIENPTVBMRVRFIi4KKworCitQQVNTIGZy
YW1lLmNvbnRlbnRXaW5kb3cgaXMgbnVsbAorUEFTUyBmcmFtZS5jb250ZW50V2luZG93IGlzIG51
bGwKK0RpZCBub3QgY3Jhc2gKK1BBU1Mgc3VjY2Vzc2Z1bGx5UGFyc2VkIGlzIHRydWUKKworVEVT
VCBDT01QTEVURQorCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L2ZyYW1lcy9yZWF0dGFj
aC1pbi11bmxvYWQuaHRtbCBiL0xheW91dFRlc3RzL2Zhc3QvZnJhbWVzL3JlYXR0YWNoLWluLXVu
bG9hZC5odG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLjE1MWVmMTkKLS0t
IC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2ZyYW1lcy9yZWF0dGFjaC1pbi11bmxv
YWQuaHRtbApAQCAtMCwwICsxLDI1IEBACis8IURPQ1RZUEUgaHRtbD4KKzxib2R5PgorPHNjcmlw
dCBzcmM9Ii4uLy4uL3Jlc291cmNlcy9qcy10ZXN0LmpzIj48L3NjcmlwdD4KKzxzY3JpcHQ+Citk
ZXNjcmlwdGlvbignRW5zdXJlIHRoYXQgcmVtb3ZpbmcgYW4gaWZyYW1lIGZyb20gdGhlIHRyZWUg
cmVzdWx0cyBpbiBmcmFtZSBkZXN0cnVjdGlvbicpOworCit2YXIgZnJhbWUgPSBkb2N1bWVudC5j
cmVhdGVFbGVtZW50KCdpZnJhbWUnKTsKK2Z1bmN0aW9uIGhhbmRsZXIoKSB7CisgICAgdmFyIHAg
PSBmcmFtZS5wYXJlbnROb2RlOworICAgIHAucmVtb3ZlQ2hpbGQoZnJhbWUpOworICAgIHAuYXBw
ZW5kQ2hpbGQoZnJhbWUpOworfQorCitkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKGZyYW1lKTsK
K2ZyYW1lLmNvbnRlbnRXaW5kb3cub251bmxvYWQgPSBoYW5kbGVyOworZnJhbWUucGFyZW50Tm9k
ZS5yZW1vdmVDaGlsZChmcmFtZSkKK3Nob3VsZEJlTnVsbCgiZnJhbWUuY29udGVudFdpbmRvdyIp
OworCit2YXIgZGl2ID0gZG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZChkb2N1bWVudC5jcmVhdGVF
bGVtZW50KCdkaXYnKSk7CitkaXYuYXBwZW5kQ2hpbGQoZnJhbWUpOworZGl2LnJlbW92ZUNoaWxk
KGZyYW1lKTsKK3Nob3VsZEJlTnVsbCgiZnJhbWUuY29udGVudFdpbmRvdyIpOworZGVidWcoJ0Rp
ZCBub3QgY3Jhc2gnKTsKKzwvc2NyaXB0PgorPC9ib2R5PgpkaWZmIC0tZ2l0IGEvU291cmNlL1dl
YkNvcmUvQ2hhbmdlTG9nIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCmluZGV4IGM2MTc0ZTAu
LmUxYTNmOTQgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZworKysgYi9Tb3Vy
Y2UvV2ViQ29yZS9DaGFuZ2VMb2cKQEAgLTEsNSArMSwyNCBAQAogMjAxNC0wMi0xNiAgQW5kcmVh
cyBLbGluZyAgPGFrbGluZ0BhcHBsZS5jb20+CiAKKyAgICAgICAgRW5zdXJlIHRoYXQgcmVtb3Zp
bmcgYW4gaWZyYW1lIGZyb20gdGhlIERPTSB0cmVlIGRpc2Nvbm5lY3RzIGl0cyBGcmFtZS4KKyAg
ICAgICAgPGh0dHBzOi8vd2Via2l0Lm9yZy9iLzEyODg4OT4KKyAgICAgICAgPHJkYXI6Ly9wcm9i
bGVtLzE1NjcxMjIxPgorCisgICAgICAgIE1lcmdlZCBmcm9tIEJsaW5rIChwYXRjaCBieSBBZGFt
IEtsZWluKToKKyAgICAgICAgaHR0cHM6Ly9zcmMuY2hyb21pdW0ub3JnL3ZpZXd2Yy9ibGluaz9y
ZXZpc2lvbj0xNTYxNzQmdmlldz1yZXZpc2lvbgorCisgICAgICAgIFN1YmZyYW1lTG9hZGluZ0Rp
c2FibGVyIHdhc24ndCBjYXRjaGluZyB0aGUgY2FzZSB3aGVuIGFuIDxpZnJhbWU+IHdhcywKKyAg
ICAgICAgaW4gaXRzIHVubG9hZCBoYW5kbGVyLCByZW1vdmVkIGFuZCByZS1hZGRlZCB0byB0aGUg
c2FtZSBwYXJlbnQuCisgICAgICAgIEZpeCB0aGlzIGJ5IHVzaW5nIGEgY291bnQgb2YgU3ViZnJh
bWVMb2FkaW5nRGlzYWJsZXJzIHRoYXQgYXJlIG9uIHRoZQorICAgICAgICBzdGFjayBmb3IgYSBn
aXZlbiByb290LCByYXRoZXIgdGhhbiBhIHNpbXBsZSBib29sZWFuLgorCisgICAgICAgIFRlc3Q6
IGZhc3QvZnJhbWVzL3JlYXR0YWNoLWluLXVubG9hZC5odG1sCisKKyAgICAgICAgKiBodG1sL0hU
TUxGcmFtZU93bmVyRWxlbWVudC5oOgorICAgICAgICAoV2ViQ29yZTo6U3ViZnJhbWVMb2FkaW5n
RGlzYWJsZXI6OmRpc2FibGVkU3VidHJlZVJvb3RzKToKKworMjAxNC0wMi0xNiAgQW5kcmVhcyBL
bGluZyAgPGFrbGluZ0BhcHBsZS5jb20+CisKICAgICAgICAgQXRvbWljaXplIGZyZXF1ZW50bHkg
aWRlbnRpY2FsIFJlc291cmNlUmVzcG9uc2Ugc3RyaW5nIG1lbWJlcnMuCiAgICAgICAgIDxodHRw
czovL3dlYmtpdC5vcmcvYi8xMjg4ODc+CiAKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2h0
bWwvSFRNTEZyYW1lT3duZXJFbGVtZW50LmggYi9Tb3VyY2UvV2ViQ29yZS9odG1sL0hUTUxGcmFt
ZU93bmVyRWxlbWVudC5oCmluZGV4IDdjMGZjMDYuLjg1Yzg0ODMgMTAwNjQ0Ci0tLSBhL1NvdXJj
ZS9XZWJDb3JlL2h0bWwvSFRNTEZyYW1lT3duZXJFbGVtZW50LmgKKysrIGIvU291cmNlL1dlYkNv
cmUvaHRtbC9IVE1MRnJhbWVPd25lckVsZW1lbnQuaApAQCAtMjIsNiArMjIsNyBAQAogI2RlZmlu
ZSBIVE1MRnJhbWVPd25lckVsZW1lbnRfaAogCiAjaW5jbHVkZSAiSFRNTEVsZW1lbnQuaCIKKyNp
bmNsdWRlIDx3dGYvSGFzaENvdW50ZWRTZXQuaD4KIAogbmFtZXNwYWNlIFdlYkNvcmUgewogCkBA
IC04OCw5ICs4OSw5IEBAIHB1YmxpYzoKICAgICBzdGF0aWMgYm9vbCBjYW5Mb2FkRnJhbWUoSFRN
TEZyYW1lT3duZXJFbGVtZW50Jik7CiAKIHByaXZhdGU6Ci0gICAgc3RhdGljIEhhc2hTZXQ8Q29u
dGFpbmVyTm9kZSo+JiBkaXNhYmxlZFN1YnRyZWVSb290cygpCisgICAgc3RhdGljIEhhc2hDb3Vu
dGVkU2V0PENvbnRhaW5lck5vZGUqPiYgZGlzYWJsZWRTdWJ0cmVlUm9vdHMoKQogICAgIHsKLSAg
ICAgICAgREVGSU5FX1NUQVRJQ19MT0NBTChIYXNoU2V0PENvbnRhaW5lck5vZGUqPiwgbm9kZXMs
ICgpKTsKKyAgICAgICAgREVGSU5FX1NUQVRJQ19MT0NBTChIYXNoQ291bnRlZFNldDxDb250YWlu
ZXJOb2RlKj4sIG5vZGVzLCAoKSk7CiAgICAgICAgIHJldHVybiBub2RlczsKICAgICB9CiAK
</data>
<flag name="commit-queue"
          id="248417"
          type_id="3"
          status="-"
          setter="commit-queue"
    />
          </attachment>
      

    </bug>

</bugzilla>