Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: cherry-pick c244270e23 from chromium. #26477

Merged
merged 2 commits into from Nov 13, 2020

Conversation

@ppontes
Copy link
Member

@ppontes ppontes commented Nov 12, 2020

Ignore RenderFrameHostImpl::Detach() for speculative RFHs.

Currently, this all happens to work by chance, because the speculative
RFH or the entire FTN happens to be torn down before the browser process
ever processes a Detach() IPC for a speculative RFH.

However, there are a number of followup CLs that restructure how
provisional RenderFrames are managed and owned in the renderer process.
To simplify those CLs, explicitly branch in Detach() based on whether or
not the RFH is speculative. In the future, additional logic may be added
to the speculative branch (e.g. cancelling the navigation, if
appropriate).

(cherry picked from commit cf054220a2e1570a9149220494de8826c2e9d4db)

Bug: 1146709
Change-Id: I6490a90f7b447422d698676665b52f6f3a6f8ffd
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2524280
Commit-Queue: Daniel Cheng dcheng@chromium.org
Reviewed-by: Nasko Oskov nasko@chromium.org
Cr-Original-Commit-Position: refs/heads/master@{#825903}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2530189
Reviewed-by: Adrian Taylor adetaylor@chromium.org
Cr-Commit-Position: refs/branch-heads/4240@{#1430}
Cr-Branched-From: f297677702651916bbf65e59c0d4bbd4ce57d1ee-refs/heads/master@{#800218}

Notes: Backported the fix to CVE-2020-16017: Browser UAF when detaching a provisional frame.

@ppontes ppontes force-pushed the ppontes/cherry-pick/9-x-y/chromium/c244270e23 branch from 130af11 to d9aa61b Nov 12, 2020
@ppontes ppontes changed the title chore: cherry-pick c244270e23 from chromium. [WIP] chore: cherry-pick c244270e23 from chromium. Nov 12, 2020
@ppontes ppontes removed the wip label Nov 12, 2020
@ppontes ppontes changed the title [WIP] chore: cherry-pick c244270e23 from chromium. chore: cherry-pick c244270e23 from chromium. Nov 12, 2020
@nornagon nornagon merged commit ef67402 into 9-x-y Nov 13, 2020
15 of 16 checks passed
Loading
@release-clerk
Copy link

@release-clerk release-clerk bot commented Nov 13, 2020

Release Notes Persisted

Backported the fix to CVE-2020-16017: Browser UAF when detaching a provisional frame.

Loading

@nornagon nornagon deleted the ppontes/cherry-pick/9-x-y/chromium/c244270e23 branch Nov 13, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

3 participants