Bug 223642

Summary: [UBSan] dom/Document.cpp:2722:23: runtime error: reference binding to null pointer of type 'JSC::CallFrame'
Product: WebKit Reporter: Chris Dumez <cdumez>
Component: DOMAssignee: Chris Dumez <cdumez>
Status: RESOLVED FIXED    
Severity: Normal CC: darin, esprehn+autocc, ews-watchlist, ggaren, kangil.han, mkwst, sam, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=176131
Attachments:
Description Flags
Patch none

Chris Dumez
Reported 2021-03-23 09:43:02 PDT
Document.cpp:2722:23: runtime error: reference binding to null pointer of type 'JSC::CallFrame'.
Attachments
Patch (1.74 KB, patch)
2021-03-23 09:46 PDT, Chris Dumez 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Chris Dumez
Comment 1 2021-03-23 09:46:49 PDT
Created attachment 424029 [details] Patch
Darin Adler
Comment 2 2021-03-23 13:10:37 PDT
Comment on attachment 424029 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=424029&action=review > Source/WebCore/dom/Document.cpp:2723 > + auto* callFrame = vm.topCallFrame; > + return callFrame && callFrame != JSC::CallFrame::noCaller() && !currentWorld(*callFrame->lexicalGlobalObject(vm)).isNormal(); Would be nice to fix other places where we dereference vm.topCallFrame without checking it for nullptr; I found some others.
EWS
Comment 3 2021-03-23 13:30:20 PDT
Committed r274895: <https://commits.webkit.org/r274895> All reviewed patches have been landed. Closing bug and clearing flags on attachment 424029 [details].
Radar WebKit Bug Importer
Comment 4 2021-03-23 13:31:13 PDT
<rdar://problem/75752414>
Note You need to log in before you can comment on or make changes to this bug.