Hardening: Prevent FrameLoader crash due to SetForScope
https://bugs.webkit.org/show_bug.cgi?id=197458
<rdar://problem/50368338>
Reviewed by Chris Dumez.
Since SetForScope takes action during a function returns, it might cause
a crash if its scope is broader than the value it is resetting.
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::loadDifferentDocumentItem):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@245464 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index e4ededd..6fa4e9f 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,17 @@
+2019-05-17 Brent Fulgham <bfulgham@apple.com>
+
+ Hardening: Prevent FrameLoader crash due to SetForScope
+ https://bugs.webkit.org/show_bug.cgi?id=197458
+ <rdar://problem/50368338>
+
+ Reviewed by Chris Dumez.
+
+ Since SetForScope takes action during a function returns, it might cause
+ a crash if its scope is broader than the value it is resetting.
+
+ * loader/FrameLoader.cpp:
+ (WebCore::FrameLoader::loadDifferentDocumentItem):
+
2019-05-16 Carlos Garcia Campos <cgarcia@igalia.com>
[GTK] Need WebKitContextMenuItemType to open emoji picker
diff --git a/Source/WebCore/loader/FrameLoader.cpp b/Source/WebCore/loader/FrameLoader.cpp
index 8e70f3c..a191f79 100644
--- a/Source/WebCore/loader/FrameLoader.cpp
+++ b/Source/WebCore/loader/FrameLoader.cpp
@@ -3696,6 +3696,8 @@
{
RELEASE_LOG_IF_ALLOWED("loadDifferentDocumentItem: frame load started (frame = %p, main = %d)", &m_frame, m_frame.isMainFrame());
+ Ref<Frame> protectedFrame(m_frame);
+
// History items should not be reported to the parent.
m_shouldReportResourceTimingToParentFrame = false;
