Changeset 112051 in webkit

Timestamp:

Mar 25, 2012, 11:11:53 PM (15 years ago)

Author:

inferno@chromium.org

Message:

Crash in ContainerNode::resumePostAttachCallbacks.
​https://bugs.webkit.org/show_bug.cgi?id=82159

Reviewed by Hajime Morita.

Source/WebCore:

Test: plugins/object-onfocus-mutation-crash.html

• dom/ContainerNode.cpp:

(WebCore::ContainerNode::resumePostAttachCallbacks): dispatching post attach
callbacks when our attach depth is 1 can fire mutation events such as onfocus
which can blow away |this|. Need to protect it with a RefPtr.

• html/HTMLPlugInImageElement.cpp:

(WebCore::HTMLPlugInImageElement::attach): add calls to suspend attach callbacks
until the function completes.

LayoutTests:

• plugins/object-onfocus-mutation-crash-expected.txt: Added.
• plugins/object-onfocus-mutation-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/plugins/object-onfocus-mutation-crash-expected.txt (added)
• LayoutTests/plugins/object-onfocus-mutation-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/ContainerNode.cpp (modified) (1 diff)
• Source/WebCore/html/HTMLPlugInImageElement.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-03-25  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in ContainerNode::resumePostAttachCallbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=82159
+
+        Reviewed by Hajime Morita.
+
+        * plugins/object-onfocus-mutation-crash-expected.txt: Added.
+        * plugins/object-onfocus-mutation-crash.html: Added.
+
 2012-03-25  Csaba Osztrogonác  <ossy@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-03-25  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in ContainerNode::resumePostAttachCallbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=82159
+
+        Reviewed by Hajime Morita.
+
+        Test: plugins/object-onfocus-mutation-crash.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::resumePostAttachCallbacks): dispatching post attach
+        callbacks when our attach depth is 1 can fire mutation events such as onfocus
+        which can blow away |this|. Need to protect it with a RefPtr.
+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::attach): add calls to suspend attach callbacks
+        until the function completes.
+
 2012-03-25  Dana Jansens  <danakj@chromium.org>
 

trunk/Source/WebCore/dom/ContainerNode.cpp

@@ -674 +674 @@
 {
     if (s_attachDepth == 1) {
+        RefPtr<ContainerNode> protect(this);
+
         if (s_postAttachCallbackQueue)
             dispatchPostAttachCallbacks();

trunk/Source/WebCore/html/HTMLPlugInImageElement.cpp

@@ -154 +154 @@
 void HTMLPlugInImageElement::attach()
 {
+    suspendPostAttachCallbacks();
+
     bool isImage = isImageType();
     
@@ -166 +168 @@
         m_imageLoader->updateFromElement();
     }
+
+    resumePostAttachCallbacks();
 }