Bug 309781
| Summary: | WebCoreTestSupport::resetInternalsObject() crashes when Document::frame() returns nullptr | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | David Kilzer (:ddkilzer) <ddkilzer> |
| Component: | Tools / Tests | Assignee: | David Kilzer (:ddkilzer) <ddkilzer> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | jbedard, webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
David Kilzer (:ddkilzer)
`WebCoreTestSupport::resetInternalsObject()` calls `document->frame()->page()` without checking whether `frame()` returns nullptr.
`Document` should always have a valid `Page` during `resetInternalsObject()` teardown. If it does not, `Document` is in an unexpected state that should be caught explicitly rather than by crashing with an uninformative nullptr dereference.
The current code also bypasses the safe accessor `Document::page()` (in `DocumentPage.h`) by calling `frame()` and `page()` as separate chained operations.
<rdar://63019644>
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
David Kilzer (:ddkilzer)
Pull request: https://github.com/WebKit/WebKit/pull/60451
Alexey Proskuryakov
Is this the same as bug 221304?
EWS
Committed 309158@main (5aee90b4e66e): <https://commits.webkit.org/309158@main>
Reviewed commits have been landed. Closing PR #60451 and removing active labels.
David Kilzer (:ddkilzer)
*** Bug 221304 has been marked as a duplicate of this bug. ***
David Kilzer (:ddkilzer)
(In reply to Alexey Proskuryakov from comment #2)
> Is this the same as bug 221304?
Yes