Bug 220869

Summary: Nullptr dereference in SpeechRecognition::stop()
Product: WebKit Reporter: Sihui Liu <sihui_liu>
Component: MediaAssignee: Sihui Liu <sihui_liu>
Status: RESOLVED FIXED    
Severity: Normal CC: aakash_jain, bfulgham, ews-feeder, product-security, rniwa, webkit-bug-importer, youennf
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Patch
none
Patch
none
Patch for landing none

Description Sihui Liu 2021-01-22 11:02:01 PST 
...
Comment 1 Radar WebKit Bug Importer 2021-01-22 11:02:12 PST Comment hidden (obsolete)
Comment 2 Sihui Liu 2021-01-22 11:19:29 PST 
Created attachment 418159 [details]
Patch
Comment 3 Sihui Liu 2021-01-22 11:20:40 PST 
<rdar://problem/73403469>
Comment 4 Sihui Liu 2021-01-22 11:21:07 PST 
Created attachment 418160 [details]
Patch
Comment 5 Ryosuke Niwa 2021-01-22 12:38:51 PST 
Comment on attachment 418160 [details]
Patch

Is there a security issue? If not, can we add a test?
Comment 6 youenn fablet 2021-01-22 13:46:34 PST 
It seems a test can be added if this is about frameless document.
Comment 7 Sihui Liu 2021-01-22 18:35:29 PST 
Created attachment 418205 [details]
Patch
Comment 8 Ryosuke Niwa 2021-01-22 22:05:38 PST 
Comment on attachment 418205 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=418205&action=review

> LayoutTests/fast/speechrecognition/detached-iframe.html:8
> +
> +

Two blank lines.

> LayoutTests/fast/speechrecognition/detached-iframe.html:11
> +if (window.testRunner) {
> +    jsTestIsAsync = true;
> +}

No curly braces around a single line statement.

> LayoutTests/fast/speechrecognition/detached-iframe.html:14
> +	var frame = document.getElementById('iframe');

Use const?
Comment 9 Sihui Liu 2021-01-24 17:24:56 PST 
Created attachment 418247 [details]
Patch for landing
Comment 10 EWS 2021-01-24 17:59:58 PST 
commit-queue failed to commit attachment 418247 [details] to WebKit repository.
Comment 11 EWS 2021-01-25 04:31:04 PST 
Committed r271791: <https://trac.webkit.org/changeset/271791>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 418247 [details].