File RenderFrameHostImpl-use-after-free.patch of Package nodejs-electron

Overview Repositories Revisions Requests Users Attributes Meta

File RenderFrameHostImpl-use-after-free.patch of Package nodejs-electron (Revision 0f8fd9c252480d634aa2b2ec5963f993)

Currently displaying revision 0f8fd9c252480d634aa2b2ec5963f993 , Show latest

--- src/content/browser/renderer_host/render_frame_host_impl.cc.orig	2023-02-08 21:38:09.974003318 +0100
+++ src/content/browser/renderer_host/render_frame_host_impl.cc	2023-02-13 14:13:50.217792624 +0100
@@ -5,6 +5,7 @@
 #include <deque>
 #include <limits>
 #include <memory>
+#include <new>
 #include <optional>
 #include <tuple>
 #include <unordered_map>
@@ -1876,7 +1877,12 @@
   // `DocumentService` and `RenderFrameHostUserData` subclasses are still valid
   // when their destructors run.
   document_associated_data_->RemoveAllServices();
-  document_associated_data_.reset();
+  // HACK: Using .reset() here works on MSVC and LLVM libc++ because the std::optional
+  // is still valid while the destructor runs. This does not work on GNU libstdc++
+  // however which invalidates the optional before calling the destructor, causing a crash.
+  // Upstream bug: https://bugs.chromium.org/p/chromium/issues/detail?id=1415154
+    document_associated_data_->~DocumentAssociatedData();
+    new(&document_associated_data_) std::optional<DocumentAssociatedData>(std::nullopt);
 
   // If this was the last active frame in the SiteInstanceGroup, the
   // DecrementActiveFrameCount call will trigger the deletion of the

Places

File RenderFrameHostImpl-use-after-free.patch of Package nodejs-electron (Revision 0f8fd9c252480d634aa2b2ec5963f993)

Places