| Summary: | [UBSan] dom/Document.cpp:2722:23: runtime error: reference binding to null pointer of type 'JSC::CallFrame' | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Chris Dumez <cdumez> | ||||
| Component: | DOM | Assignee: | Chris Dumez <cdumez> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | darin, esprehn+autocc, ews-watchlist, ggaren, kangil.han, mkwst, sam, webkit-bug-importer | ||||
| Priority: | P2 | Keywords: | InRadar | ||||
| Version: | WebKit Nightly Build | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| See Also: | https://bugs.webkit.org/show_bug.cgi?id=176131 | ||||||
| Attachments: |
|
||||||
|
Description
Chris Dumez
2021-03-23 09:43:02 PDT
Created attachment 424029 [details]
Patch
Comment on attachment 424029 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=424029&action=review > Source/WebCore/dom/Document.cpp:2723 > + auto* callFrame = vm.topCallFrame; > + return callFrame && callFrame != JSC::CallFrame::noCaller() && !currentWorld(*callFrame->lexicalGlobalObject(vm)).isNormal(); Would be nice to fix other places where we dereference vm.topCallFrame without checking it for nullptr; I found some others. Committed r274895: <https://commits.webkit.org/r274895> All reviewed patches have been landed. Closing bug and clearing flags on attachment 424029 [details]. |