tree aad8cc26b382bf7b4eec37b6c2a8351c08b3015c
parent cda6b2ff89fbc9cb5ccad392c9e383f1dd588104
author Antonio Sartori <antoniosartori@chromium.org> 1608114077 -0800
committer Blink WPT Bot <blink-w3c-test-autoroller@chromium.org> 1608116416 -0800

Fix nullptr dereference accessing PolicyContainer in Blink

When parsing a referrer policy from a meta tag, we were trying to
update the PolicyContainer (and with it, the PolicyContainerHost in
the Browser process) without checking for it not to be
nullptr. However, the PolicyContainer is nullptr for LocalFrames which
have no RenderFrameHost counterpart in the browser, which are used for
rendering SVG images. As a consequence, there are cases in which a
meta tag in an SVG image made the renderer crash.

This change adds a nullptr check to fix this.

Bug: 1158034, 1130587
Change-Id: Ia0b5c51b4d1d68cfd7329da8c5e153bdef7deb3c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2593000
Commit-Queue: Antonio Sartori <antoniosartori@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Cr-Commit-Position: refs/heads/master@{#837507}