Changeset 228493 in webkit

Timestamp:

Feb 14, 2018 3:50:04 PM (6 years ago)

Author:

jmarcell@apple.com

Message:

Cherry-pick r228476. rdar://problem/37549912

Location:

tags/Safari-605.1.27.2.1/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/HTMLPlugInElement.cpp (modified) (1 diff)

tags/Safari-605.1.27.2.1/Source/WebCore/ChangeLog

@@ +1 @@
+2018-02-14  Jason Marcell  <jmarcell@apple.com>
+
+        Cherry-pick r228476. rdar://problem/37549912
+
+    2018-02-14  Dean Jackson  <dino@apple.com>
+
+            CrashTracer: com.apple.WebKit.WebContent at com.apple.WebCore: WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot + 618
+            https://bugs.webkit.org/show_bug.cgi?id=182798
+            <rdar://problem/23337253>
+
+            Reviewed by Eric Carlson.
+
+            Speculative fix for a crash in HTMLPlugInImageElement::didAddUserAgentShadowRoot.
+            The guess is that the m_swapRendererTimer is set, and the display state changes to
+            something that does not require a shadow root, but before the timer fires.
+            Fix this by ensuring that the timer is reset on every display state change.
+
+            * html/HTMLPlugInElement.cpp:
+            (WebCore::HTMLPlugInElement::setDisplayState): Guard for sets that wouldn't
+            actually change value, and make sure we always reset the timer.
+
 2018-02-14  Jason Marcell  <jmarcell@apple.com>
 

tags/Safari-605.1.27.2.1/Source/WebCore/html/HTMLPlugInElement.cpp

@@ -287 +287 @@
 void HTMLPlugInElement::setDisplayState(DisplayState state)
 {
+    if (state == m_displayState)
+        return;
+
     m_displayState = state;
     
-    if ((state == DisplayingSnapshot || displayState() == PreparingPluginReplacement) && !m_swapRendererTimer.isActive())
+    m_swapRendererTimer.stop();
+    if (state == DisplayingSnapshot || displayState() == PreparingPluginReplacement)
         m_swapRendererTimer.startOneShot(0_s);
 }