Bug 223642 - [UBSan] dom/Document.cpp:2722:23: runtime error: reference binding to null pointer of type 'JSC::CallFrame'
Summary: [UBSan] dom/Document.cpp:2722:23: runtime error: reference binding to null po...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Chris Dumez
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2021-03-23 09:43 PDT by Chris Dumez
Modified: 2021-03-23 13:31 PDT (History)
8 users (show)

See Also:


Attachments
Patch (1.74 KB, patch)
2021-03-23 09:46 PDT, Chris Dumez
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Dumez 2021-03-23 09:43:02 PDT
Document.cpp:2722:23: runtime error: reference binding to null pointer of type 'JSC::CallFrame'.
Comment 1 Chris Dumez 2021-03-23 09:46:49 PDT
Created attachment 424029 [details]
Patch
Comment 2 Darin Adler 2021-03-23 13:10:37 PDT
Comment on attachment 424029 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=424029&action=review

> Source/WebCore/dom/Document.cpp:2723
> +    auto* callFrame = vm.topCallFrame;
> +    return callFrame && callFrame != JSC::CallFrame::noCaller() && !currentWorld(*callFrame->lexicalGlobalObject(vm)).isNormal();

Would be nice to fix other places where we dereference vm.topCallFrame without checking it for nullptr; I found some others.
Comment 3 EWS 2021-03-23 13:30:20 PDT
Committed r274895: <https://commits.webkit.org/r274895>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 424029 [details].
Comment 4 Radar WebKit Bug Importer 2021-03-23 13:31:13 PDT
<rdar://problem/75752414>