| Summary: | Remove FrameLoader::cancelAndClear | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Rob Buis <rbuis> | ||||||
| Component: | Page Loading | Assignee: | Rob Buis <rbuis> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | Normal | CC: | achristensen, beidson, cdumez, ews-watchlist, japhet, webkit-bug-importer | ||||||
| Priority: | P2 | Keywords: | InRadar | ||||||
| Version: | WebKit Nightly Build | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Attachments: |
|
||||||||
|
Description
Rob Buis
2020-12-14 07:11:18 PST
Created attachment 416154 [details]
Patch
Comment on attachment 416154 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=416154&action=review > Source/WebCore/page/Frame.h:340 > + FrameLoader* m_loader; We don't want to increase the storage of raw pointers. This is how use-after-free bugs arise. Created attachment 416245 [details]
Patch
Comment on attachment 416154 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=416154&action=review >> Source/WebCore/page/Frame.h:340 >> + FrameLoader* m_loader; > > We don't want to increase the storage of raw pointers. This is how use-after-free bugs arise. That is a good rule. It is just a pity that the smart pointers do not work well in this case, i.e call the destructor but keep the inner raw pointer around while the destructor is in process. Anyway, I found an alternative approach. Committed r270881: <https://trac.webkit.org/changeset/270881> All reviewed patches have been landed. Closing bug and clearing flags on attachment 416245 [details]. |