Changeset 228476 in webkit

Timestamp:

Feb 14, 2018 11:34:35 AM (6 years ago)

Author:

dino@apple.com

Message:

CrashTracer: com.apple.WebKit.WebContent at com.apple.WebCore: WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot + 618
​https://bugs.webkit.org/show_bug.cgi?id=182798
<rdar://problem/23337253>

Reviewed by Eric Carlson.

Speculative fix for a crash in HTMLPlugInImageElement::didAddUserAgentShadowRoot.
The guess is that the m_swapRendererTimer is set, and the display state changes to
something that does not require a shadow root, but before the timer fires.
Fix this by ensuring that the timer is reset on every display state change.

• html/HTMLPlugInElement.cpp:

(WebCore::HTMLPlugInElement::setDisplayState): Guard for sets that wouldn't
actually change value, and make sure we always reset the timer.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/HTMLPlugInElement.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2018-02-14  Dean Jackson  <dino@apple.com>
+
+        CrashTracer: com.apple.WebKit.WebContent at com.apple.WebCore: WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot + 618
+        https://bugs.webkit.org/show_bug.cgi?id=182798
+        <rdar://problem/23337253>
+
+        Reviewed by Eric Carlson.
+
+        Speculative fix for a crash in HTMLPlugInImageElement::didAddUserAgentShadowRoot.
+        The guess is that the m_swapRendererTimer is set, and the display state changes to
+        something that does not require a shadow root, but before the timer fires.
+        Fix this by ensuring that the timer is reset on every display state change.
+
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::setDisplayState): Guard for sets that wouldn't
+        actually change value, and make sure we always reset the timer.
+
 2018-02-14  Antoine Quint  <graouts@apple.com>
 

trunk/Source/WebCore/html/HTMLPlugInElement.cpp

@@ -287 +287 @@
 void HTMLPlugInElement::setDisplayState(DisplayState state)
 {
+    if (state == m_displayState)
+        return;
+
     m_displayState = state;
     
-    if ((state == DisplayingSnapshot || displayState() == PreparingPluginReplacement) && !m_swapRendererTimer.isActive())
+    m_swapRendererTimer.stop();
+    if (state == DisplayingSnapshot || displayState() == PreparingPluginReplacement)
         m_swapRendererTimer.startOneShot(0_s);
 }