Title: [295704] trunk/Source
- Revision
- 295704
- Author
- [email protected]
- Date
- 2022-06-21 17:15:30 -0700 (Tue, 21 Jun 2022)
Log Message
constructJSHTMLElement() should protect `document` and `elementInterface`
https://bugs.webkit.org/show_bug.cgi?id=241827
<rdar://94610860>
Reviewed by Mark Lam.
* Source/WebCore/bindings/js/JSHTMLElementCustom.cpp:
(WebCore::constructJSHTMLElement):
* Source/WebKit/WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::runModal):
Canonical link: https://commits.webkit.org/251709@main
Modified Paths
Diff
Modified: trunk/Source/WebCore/bindings/js/JSHTMLElementCustom.cpp (295703 => 295704)
--- trunk/Source/WebCore/bindings/js/JSHTMLElementCustom.cpp 2022-06-21 23:57:05 UTC (rev 295703)
+++ trunk/Source/WebCore/bindings/js/JSHTMLElementCustom.cpp 2022-06-22 00:15:30 UTC (rev 295704)
@@ -78,6 +78,9 @@
return throwVMTypeError(lexicalGlobalObject, scope, "new.target does not define a custom element"_s);
if (!elementInterface->isUpgradingElement()) {
+ Ref<Document> protectedDocument(document);
+ Ref<JSCustomElementInterface> protectedElementInterface(*elementInterface);
+
Structure* baseStructure = getDOMStructure<JSHTMLElement>(vm, *newTargetGlobalObject);
auto* newElementStructure = InternalFunction::createSubclassStructure(lexicalGlobalObject, newTarget, baseStructure);
RETURN_IF_EXCEPTION(scope, { });
Modified: trunk/Source/WebKit/WebProcess/WebPage/WebPage.cpp (295703 => 295704)
--- trunk/Source/WebKit/WebProcess/WebPage/WebPage.cpp 2022-06-21 23:57:05 UTC (rev 295703)
+++ trunk/Source/WebKit/WebProcess/WebPage/WebPage.cpp 2022-06-22 00:15:30 UTC (rev 295704)
@@ -5861,7 +5861,6 @@
Ref<WebPage> protector(*this);
#endif
RunLoop::run();
- ASSERT(!m_isRunningModal);
}
bool WebPage::canHandleRequest(const WebCore::ResourceRequest& request)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
