Changeset 185837 in webkit

Timestamp:

Jun 22, 2015, 12:30:46 PM (11 years ago)

Author:

andersca@apple.com

Message:

Crashes in hit testing under WebPage::acceptsFirstMouse() while handling sync message in plug-in teardown
​https://bugs.webkit.org/show_bug.cgi?id=146211
rdar://problem/17180615

Reviewed by Sam Weinig.

If we're inside a sendSync message when we're being called, just bail.

• WebProcess/WebPage/mac/WebPageMac.mm:

(WebKit::WebPage::acceptsFirstMouse):

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/WebPage/mac/WebPageMac.mm (modified) (1 diff)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2015-06-22  Anders Carlsson  <andersca@apple.com>
+
+        Crashes in hit testing under WebPage::acceptsFirstMouse() while handling sync message in plug-in teardown
+        https://bugs.webkit.org/show_bug.cgi?id=146211
+        rdar://problem/17180615
+
+        Reviewed by Sam Weinig.
+
+        If we're inside a sendSync message when we're being called, just bail.
+
+        * WebProcess/WebPage/mac/WebPageMac.mm:
+        (WebKit::WebPage::acceptsFirstMouse):
+
 2015-06-22  Dan Bernstein  <mitz@apple.com>
 

trunk/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm

@@ -844 +844 @@
 {
     result = false;
+
+    if (WebProcess::singleton().parentProcessConnection()->inSendSync()) {
+        // In case we're already inside a sendSync message, it's possible that the page is in a
+        // transitionary state, so any hit-testing could cause crashes  so we just return early in that case.
+        return;
+    }
+
     Frame& frame = m_page->focusController().focusedOrMainFrame();