null ptr deref in WebCore::HTMLModelElement::enterFullscreen()

• Component: New Bugs
• Status: RESOLVED FIXED

[Gabriel Nava Marino]

m_modelPlayer is a RefPtr that can become nullptr, so it needs a check before dereferencing.

<rdar://problem/88475491>

[Gabriel Nava Marino]

Created attachment 451445 [details]
Patch

[Antoine Quint]

This method is only defined on Cocoa ports, so make sure to only run this test on those platforms.

[Gabriel Nava Marino]

Created attachment 451574 [details]
Patch

[Gabriel Nava Marino]

(In reply to Antoine Quint from comment #2)
> This method is only defined on Cocoa ports, so make sure to only run this
> test on those platforms.

Thank you, I have updated TestExpectations for those platforms.

[Tim Nguyen (:ntim)]

Comment on attachment 451574 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=451574&action=review

> Source/WebCore/ChangeLog:14
> +        Test: fast/model-element/model-element-enter-fullscreen-crash.html

Can you move this test in the LayoutTests/model-element folder instead of creating a new subfolder under LayoutTests/fast ?

The LayoutTests/model-element folder is already correctly skipped on non-Cocoa platforms, so you can also remove your changes in the gtk/win TestExpectations files.

[Gabriel Nava Marino]

Created attachment 451715 [details]
Patch

[Antoine Quint]

Comment on attachment 451715 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=451715&action=review

> LayoutTests/model-element/model-element-enter-fullscreen-crash.html:3
> +  internals.settings.setModelElementEnabled(true);

You don't need that line, it's already enabled in WKTR.

[Gabriel Nava Marino]

Created attachment 451923 [details]
Patch

[EWS]

Committed r289794 (247259@main): <https://commits.webkit.org/247259@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 451923 [details].