Skip to content

GitLab

T
tangled
Commit 61966fae authored by David Bokan's avatar David Bokan Committed by Commit Bot
Browse files
Options

Fix nullptr crash in fragment navigation 

The focus call in fragment navigation can run arbitrary script which can
cause the document to become detached. Thus, we need to check whether
we're still attached before continuing.

Bug: 837255
Change-Id: I4b35f66e39ace801a59230234264757ba4d6be04
Reviewed-on: https://chromium-review.googlesource.com/1033958Reviewed-by: default avatarSteve Kobes <skobes@chromium.org>
Commit-Queue: David Bokan <bokan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#554775}
parent 01dc60ba
Hide whitespace changes
Inline Side-by-side
Showing with 32 additions and 3 deletions
third_party/WebKit/LayoutTests/fast/scrolling/detach-during-scroll-to-fragment-doesnt-crash.html 0 → 100644
View file @ 61966fae
<!DOCTYPE>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<body>
<script>
test( () => {
const iframe = document.createElement('iframe')
document.body.appendChild(iframe);
const button = document.createElement('button');
iframe.contentDocument.body.appendChild(button);
button.id = 'button';
button.onfocus = () => {
// This will detach the iframe's document from its frame before
// reattaching to the DOM and creating a new document. Ensure nothing
// touches the cleared frame.
document.body.appendChild(iframe);
};
// Cause the button to be focused and scrolled into view.
iframe.contentWindow.location.hash = 'button';
}, "Detaching document during scroll to fragment doesn't crash");
</script>
</body>
third_party/blink/renderer/core/dom/document.cc
View file @ 61966fae
...@@ -2366,10 +2366,15 @@ void Document::UpdateStyleAndLayout() { ...@@ -2366,10 +2366,15 @@ void Document::UpdateStyleAndLayout() {
} }
void Document::LayoutUpdated() { void Document::LayoutUpdated() {
DCHECK(GetFrame());
DCHECK(View());
// If we're restoring a scroll position from history, that takes precedence
// over scrolling to the anchor in the URL.
View()->ScrollAndFocusFragmentAnchor();
// Script run in the call above may detach the document.
if (GetFrame() && View()) { if (GetFrame() && View()) {
// If we're restoring a scroll position from history, that takes precedence
// over scrolling to the anchor in the URL.
View()->ScrollAndFocusFragmentAnchor();
GetFrame()->Loader().RestoreScrollPositionAndViewState(); GetFrame()->Loader().RestoreScrollPositionAndViewState();
// The focus call above can execute JS which can dirty layout. Ensure // The focus call above can execute JS which can dirty layout. Ensure
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment