github/electron
1
1
Fork 0
mirror of https://github.com/electron/electron.git synced 2026-04-10 03:01:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: RenderFrameHost nullptr dereference (#45510)

Browse Source 
* fix: add nullptr tests before using render_frame_

Co-authored-by: Charles Kerr <charles@charleskerr.com>

* refactor: extract-method HasRenderFrame()

Co-authored-by: Charles Kerr <charles@charleskerr.com>

---------

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: Charles Kerr <charles@charleskerr.com>
This commit is contained in:
trop[bot]
2025-02-07 10:02:55 +01:00
committed by GitHub
parent b83b8ef851
commit bba618f4d3
2 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
shell/browser/api/electron_api_web_frame_main.cc
View File

@@ -184,7 +184,7 @@ void WebFrameMain::UpdateRenderFrameHost(content::RenderFrameHost* rfh) {
}
bool WebFrameMain::CheckRenderFrame() const {
if (render_frame_disposed_) {
if (!HasRenderFrame()) {
v8::Isolate* isolate = JavascriptEnvironment::GetIsolate();
v8::HandleScope scope(isolate);
gin_helper::ErrorThrower(isolate).ThrowError(
@@ -436,7 +436,7 @@ v8::Local<v8::Promise> WebFrameMain::CollectDocumentJSCallStack(
gin_helper::Promise<base::Value> promise(args->isolate());
v8::Local<v8::Promise> handle = promise.GetHandle();
if (render_frame_disposed_) {
if (!HasRenderFrame()) {
promise.RejectWithErrorMessage(
"Render frame was disposed before WebFrameMain could be accessed");
return handle;
@@ -464,7 +464,7 @@ void WebFrameMain::CollectedJavaScriptCallStack(
gin_helper::Promise<base::Value> promise,
const std::string& untrusted_javascript_call_stack,
const std::optional<blink::LocalFrameToken>& remote_frame_token) {
if (render_frame_disposed_) {
if (!HasRenderFrame()) {
promise.RejectWithErrorMessage(
"Render frame was disposed before call stack was received");
return;

10
shell/browser/api/electron_api_web_frame_main.h
View File

@@ -101,8 +101,14 @@ class WebFrameMain final : public gin::Wrappable<WebFrameMain>,
void TeardownMojoConnection();
void OnRendererConnectionError();
// WebFrameMain can outlive its RenderFrameHost pointer so we need to check
// whether its been disposed of prior to accessing it.
[[nodiscard]] constexpr bool HasRenderFrame() const {
return !render_frame_disposed_ && render_frame_ != nullptr;
}
// Throws a JS error if HasRenderFrame() is false.
// WebFrameMain can outlive its RenderFrameHost pointer,
// so we need to check whether its been disposed of
// prior to accessing it.
bool CheckRenderFrame() const;
v8::Local<v8::Promise> ExecuteJavaScript(gin::Arguments* args,