Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 682966d153bc87682a8e73f726765e50664ea1e4
https://github.com/WebKit/WebKit/commit/682966d153bc87682a8e73f726765e50664ea1e4
Author: David Kilzer <[email protected]>
Date: 2026-03-30 (Mon, 30 Mar 2026)
Changed paths:
M Source/WebCore/loader/DocumentLoader.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp
Log Message:
-----------
Crash due to nullptr deref in
WebLocalFrameLoaderClient::dispatchDidChangeProvisionalURL()
<https://bugs.webkit.org/show_bug.cgi?id=311020>
<rdar://112727550>
Reviewed by Charlie Wolfe.
Add a null check for `provisionalDocumentLoader()` in
`dispatchDidChangeProvisionalURL()`, matching the identical
pattern in the adjacent
`dispatchDidReceiveServerRedirectForProvisionalLoad()` (added
in Bug 199123, 213141@main). The function unconditionally
dereferences the raw pointer via `Ref`, crashing when
`provisionalDocumentLoader()` returns nullptr during redirect
processing.
Remove the diagnostic-only nullptr check in the caller,
`DocumentLoader::setRequest()` (added in Bug 203837,
217227@main), since the callee now handles this case with a
`RELEASE_LOG_FAULT` and early return.
Also adopt `std::to_underlying()` in place of
`static_cast<uint8_t>()` for the `FrameState` enum in the
adjacent function's existing `RELEASE_LOG_FAULT` call.
Unable to write a layout test or API test to trigger the
crash.
* Source/WebCore/loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::setRequest):
* Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp:
(WebKit::WebLocalFrameLoaderClient::dispatchDidReceiveServerRedirectForProvisionalLoad):
(WebKit::WebLocalFrameLoaderClient::dispatchDidChangeProvisionalURL):
Canonical link: https://commits.webkit.org/310279@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
