New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 754217 link

Starred by 1 user
Status: Fixed
Owner:
█ yzshen@chromium.org
Last visit > 30 days ago
Closed: Aug 2017
Cc:
vakh@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug


Show other hotlists

Hotlists containing this issue:
Hotlist-1


Sign in to add a comment

Handle Mojo SafeBrowsing lookups from SharedWorker and ServiceWorker

Project Member Reported by ricea@chromium.org, Aug 10 2017 
WebSocket SafeBrowsing had a crash bug which would cause crashes when a WebSocket was opened from a SharedWorker or ServiceWorker:  issue 750278 .

The problem is that content::RenderFrame::FromWebFrame(frame); returns a null pointer in this case.

Based on code inspection, it appears that the http Mojo SafeBrowsing path also has the same issue. See https://chromium-review.googlesource.com/c/602088 for the WebSocket fix.

Comment 1 by yzshen@chromium.org, Aug 10 2017 

Thanks for letting me know!

It seems the current code for subresources, the safe browsing path won't crash: RenderFrame::FromWebFrame(frame) is done in ChromeContentRendererClient::WillSendRequest(). This method is in turn called by RenderFrameImpl::WillSendRequest() supplying its own blink::WebLocalFrame. In this case RenderFrame::FromWebFrame(frame) will never be null I think.

But this might be implicit and fragile, a null check might be better.

Comment 2 by nparker@chromium.org, Aug 11 2017

Labels: SafeBrowsing-Triaged
Project Member

Comment 3 by bugdroid1@chromium.org, Aug 15 2017 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/3a0411351a55560fc38c1ee49061380584c689d8

commit 3a0411351a55560fc38c1ee49061380584c689d8
Author: Yuzhu Shen <yzshen@chromium.org>
Date: Tue Aug 15 18:49:46 2017

Renderer-side SafeBrowsing: handle content::RenderFrame::FromWebFrame() returning null.

Without this change, the safe browsing path shouldn't crash either:
RenderFrame::FromWebFrame(frame) is done in
ChromeContentRendererClient::WillSendRequest(). This method is called by
RenderFrameImpl::WillSendRequest() supplying its own blink::WebLocalFrame. In
this case RenderFrame::FromWebFrame(frame) will never be null I think.

But this might be implicit and fragile, a null check might be better.

Bug:  754217 
Change-Id: I6f424bca03e007deef332b2b816ec3c36e771b62
Reviewed-on: https://chromium-review.googlesource.com/614626
Commit-Queue: Yuzhu Shen <yzshen@chromium.org>
Reviewed-by: John Abd-El-Malek <jam@chromium.org>
Cr-Commit-Position: refs/heads/master@{#494469}
[modify] https://crrev.com/3a0411351a55560fc38c1ee49061380584c689d8/chrome/renderer/chrome_content_renderer_client.cc

Comment 4 by yzshen@chromium.org, Aug 15 2017

Status: Fixed (was: Assigned)
►

Sign in to add a comment