167030 2017-01-13 16:04:15 -0800 Avoid nullptr frame dereference when scrollTo is called on a disconnected DOMWindow 2017-01-15 13:54:15 -0800 1 1 1 Unclassified WebKit Layout and Rendering WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 bfulgham bfulgham bfulgham commit-queue dbates simon.fraser zalan oldest_to_newest 1266641 0 bfulgham 2017-01-13 16:04:15 -0800 All of the functions in DOMWindow properly check that the frame is non-nullptr before using it. All, except for DOMWindow::scrollTo. This patch corrects this oversight and avoids a potential crash. 1266642 1 bfulgham 2017-01-13 16:04:28 -0800 <rdar://problem/29995070> 1266645 2 298805 bfulgham 2017-01-13 16:09:17 -0800 Created attachment 298805 Patch 1266654 3 bfulgham 2017-01-13 16:37:58 -0800 Committed r210750: <http://trac.webkit.org/changeset/210750> 1266763 4 simon.fraser 2017-01-13 20:03:17 -0800 Why is there no test? 298805 2017-01-13 16:09:17 -0800 2017-01-13 16:19:30 -0800 Patch bug-167030-20170113160735.patch text/plain 1379 bfulgham SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDIxMDc0OCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE3IEBACisyMDE3LTAxLTEzICBCcmVudCBG dWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUuY29tPgorCisgICAgICAgIEF2b2lkIG51bGxwdHIgZnJh bWUgZGVyZWZlcmVuY2Ugd2hlbiBzY3JvbGxUbyBpcyBjYWxsZWQgb24gYSBkaXNjb25uZWN0ZWQg RE9NV2luZG93CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9p ZD0xNjcwMzAKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzI5OTk1MDcwPgorCisgICAgICAgIFJl dmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIENvcnJlY3QgRE9NV2luZG93Ojpz Y3JvbGxUbyB0byBtYXRjaCBhbGwgb3RoZXIgZnVuY3Rpb25zIGluIHRoZSBjbGFzcyBzbyB0aGF0 IHRoZSBpdAorICAgICAgICBjaGVja3MgdGhhdCB0aGUgY3VycmVudCBmcmFtZSBpcyB2YWxpZCBi ZWZvcmUgYXR0ZW1wdGluZyB0byB1c2UgaXQuCisKKyAgICAgICAgKiBwYWdlL0RPTVdpbmRvdy5j cHA6CisgICAgICAgIChXZWJDb3JlOjpET01XaW5kb3c6OnNjcm9sbFRvKToKKwogMjAxNy0wMS0x MyAgSmVyIE5vYmxlICA8amVyLm5vYmxlQGFwcGxlLmNvbT4KIAogICAgICAgICBVc2UgYSBzdHJv bmcgcmVmZXJlbmNlIHdoZW4gY2FsbGluZyBjYWxsT25NYWluVGhyZWFkIHRvIHNjaGVkdWxlIGV2 ZW50cyBpbiBBdWRpb1NjaGVkdWxlZFNvdXJjZU5vZGUuCkluZGV4OiBTb3VyY2UvV2ViQ29yZS9w YWdlL0RPTVdpbmRvdy5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvcGFnZS9ET01X aW5kb3cuY3BwCShyZXZpc2lvbiAyMTA3MzkpCisrKyBTb3VyY2UvV2ViQ29yZS9wYWdlL0RPTVdp bmRvdy5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTE1NjUsNiArMTU2NSw5IEBAIHZvaWQgRE9NV2lu ZG93OjpzY3JvbGxCeShkb3VibGUgeCwgZG91YmwKIAogdm9pZCBET01XaW5kb3c6OnNjcm9sbFRv KGNvbnN0IFNjcm9sbFRvT3B0aW9ucyYgb3B0aW9ucykgY29uc3QKIHsKKyAgICBpZiAoIWlzQ3Vy cmVudGx5RGlzcGxheWVkSW5GcmFtZSgpKQorICAgICAgICByZXR1cm47CisKICAgICBSZWZQdHI8 RnJhbWVWaWV3PiB2aWV3ID0gbV9mcmFtZS0+dmlldygpOwogICAgIGlmICghdmlldykKICAgICAg ICAgcmV0dXJuOwo=