Skip to content

GitLab

T
tangled
Commit 0213d77d authored by Karandeep Bhatia's avatar Karandeep Bhatia Committed by Commit Bot
Browse files
Options

Early exit in SVGFEImageElement::FetchImageResource when there's no ExecutionContext. 

Node::GetExecutionContext can return null after the document has been
shut down. Early return in SVGFEImageElement::FetchImageResource to
prevent a null dereference.

BUG=1125293

Change-Id: I130840104b61f072c3c2d3b4d067d6d0be0789c3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2411394
Commit-Queue: Karan Bhatia <karandeepb@chromium.org>
Auto-Submit: Karan Bhatia <karandeepb@chromium.org>
Reviewed-by: default avatarNate Chapin <japhet@chromium.org>
Cr-Commit-Position: refs/heads/master@{#810775}
parent 9c5c755e
Hide whitespace changes
Inline Side-by-side
Showing with 19 additions and 0 deletions
third_party/blink/renderer/core/svg/svg_fe_image_element.cc
View file @ 0213d77d
......@@ -76,6 +76,9 @@ void SVGFEImageElement::ClearResourceReferences() {
}
void SVGFEImageElement::FetchImageResource() {
if (!GetExecutionContext())
return;
ResourceLoaderOptions options(GetExecutionContext()->GetCurrentWorld());
options.initiator_info.name = localName();
FetchParameters params(
......
third_party/blink/web_tests/svg/dom/null-execution-context-crash.html 0 → 100644
View file @ 0213d77d
<!DOCTYPE html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<body></body>
<script>
test(function() {
// Regression test for crbug.com/1125293.
let svg = document.createElementNS("http://www.w3.org/2000/svg", "feImage");
let body = document.body;
body.appendChild(svg);
let iframe = document.createElement('iframe');
body.appendChild(iframe);
iframe.contentDocument.body.appendChild(body);
});
</script>
</body>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment