github/electron
1
1
Fork 0
mirror of https://github.com/electron/electron.git synced 2026-04-10 03:01:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

chore: cherry-pick d6946b70b431 from chromium (#37849)

Browse Source 
* chore: cherry-pick d6946b70b431 from chromium

* chore: update patches

---------

Co-authored-by: PatchUp <73610968+patchup[bot]@users.noreply.github.com>
This commit is contained in:
Pedro Pontes
2023-04-06 10:52:45 +01:00
committed by GitHub
parent 26873597a1
commit b3ef435586
2 changed files with 48 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
patches/chromium/.patches
View File

@@ -127,3 +127,4 @@ expose_v8initializer_codegenerationcheckcallbackinmainthread.patch
chore_patch_out_profile_methods_in_profile_selections_cc.patch
fix_x11_window_restore_minimized_maximized_window.patch
chore_defer_usb_service_getdevices_request_until_usb_service_is.patch
cherry-pick-d6946b70b431.patch

47
patches/chromium/cherry-pick-d6946b70b431.patch Normal file
View File

@@ -0,0 +1,47 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Dave Tapuska <dtapuska@chromium.org>
Date: Fri, 24 Mar 2023 19:32:54 +0000
Subject: Move the edit commands to an on stack variable
DevTools uses nested event loops and the usage of the class member can
be problematic for iteration because the nested loop can change the
variable's storage causing a UAF.
(cherry picked from commit d9b34f0f3a2d0dd73648eca3ef940fb66806227b)
Bug: 1420510
Change-Id: Ie08a71b60401fa4322cca0cc31062ba64672126a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4355811
Reviewed-by: David Bokan <bokan@chromium.org>
Commit-Queue: Dave Tapuska <dtapuska@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1120123}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4369603
Cr-Commit-Position: refs/branch-heads/5615@{#809}
Cr-Branched-From: 9c6408ef696e83a9936b82bbead3d41c93c82ee4-refs/heads/main@{#1109224}
diff --git a/third_party/blink/renderer/core/frame/web_frame_widget_impl.cc b/third_party/blink/renderer/core/frame/web_frame_widget_impl.cc
index 7d3c2c0a0db83ae5b7980deedd605174837fa801..0da9bc6d464f09d81c0bd8943f74370ee81325b0 100644
--- a/third_party/blink/renderer/core/frame/web_frame_widget_impl.cc
+++ b/third_party/blink/renderer/core/frame/web_frame_widget_impl.cc
@@ -3198,11 +3198,18 @@ void WebFrameWidgetImpl::AddEditCommandForNextKeyEvent(const WebString& name,
}
bool WebFrameWidgetImpl::HandleCurrentKeyboardEvent() {
- bool did_execute_command = false;
+ if (edit_commands_.empty()) {
+ return false;
+ }
WebLocalFrame* frame = FocusedWebLocalFrameInWidget();
if (!frame)
frame = local_root_;
- for (const auto& command : edit_commands_) {
+ bool did_execute_command = false;
+ // Executing an edit command can run JS and we can end up reassigning
+ // `edit_commands_` so move it to a stack variable before iterating on it.
+ Vector<mojom::blink::EditCommandPtr> edit_commands =
+ std::move(edit_commands_);
+ for (const auto& command : edit_commands) {
// In gtk and cocoa, it's possible to bind multiple edit commands to one
// key (but it's the exception). Once one edit command is not executed, it
// seems safest to not execute the rest.