1459701 - ContentParent::UnregisterRemoteFrame doesn't handle the case where aCpId isn't a valid ContentProcessId

Status: RESOLVED FIXED

(Core :: DOM: Content Processes, defect)

Description

[Alex Gaynor [:Alex_Gaynor]]

This was discovered while fuzzing.

https://searchfox.org/mozilla-central/source/dom/ipc/ContentParent.cpp#4409

If |cpm->GetContentProcessById(aCpId)| returns |nullptr| then it will crash. Other methods such as ContentParent::NotifyTabDestroying handle this case.

Comment 1

[Alex Gaynor [:Alex_Gaynor]]

Attachment: Bug 1459701 - Don't crash if ContentParent::UnregisterRemoteFrame is called with a ContentParentId that doesn't exist;

Review commit: https://reviewboard.mozilla.org/r/242140/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/242140/

Comment 2

[Jim Mathies [:jimm]]

Comment on attachment 8973776 [details]
Bug 1459701 - Don't crash if ContentParent::UnregisterRemoteFrame is called with a ContentParentId that doesn't exist;

https://reviewboard.mozilla.org/r/242140/#review248060

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2f3202e4c41d
Don't crash if ContentParent::UnregisterRemoteFrame is called with a ContentParentId that doesn't exist; r=jimm

Comment 4

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/mozilla-central/rev/2f3202e4c41d