Changeset 243291 in webkit

Timestamp:

Mar 21, 2019, 8:51:07 AM (7 years ago)

Author:

Brent Fulgham

Message:

Fix possible memory leak when dismissing a color picker
​https://bugs.webkit.org/show_bug.cgi?id=196026
<rdar://problem/48778568>

Reviewed by Wenson Hsieh.

Fix a problem with WebPageProxy::endColorPicker where an early return could leave a color picker
with a +1 reference count after dismissing it.

• UIProcess/WebColorPicker.cpp:

(WebKit::WebColorPicker::endPicker):

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::endColorPicker):
(WebKit::WebPageProxy::didEndColorPicker):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/WebColorPicker.cpp (modified) (2 diffs)
• UIProcess/WebPageProxy.cpp (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-03-21  Brent Fulgham  <bfulgham@apple.com>
+
+        Fix possible memory leak when dismissing a color picker
+        https://bugs.webkit.org/show_bug.cgi?id=196026
+        <rdar://problem/48778568>
+
+        Reviewed by Wenson Hsieh.
+
+        Fix a problem with WebPageProxy::endColorPicker where an early return could leave a color picker
+        with a +1 reference count after dismissing it.
+
+        * UIProcess/WebColorPicker.cpp:
+        (WebKit::WebColorPicker::endPicker):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::endColorPicker):
+        (WebKit::WebPageProxy::didEndColorPicker):
+
 2019-03-21  Carlos Garcia Campos  <cgarcia@igalia.com>
 

trunk/Source/WebKit/UIProcess/WebColorPicker.cpp

@@ -1 +1 @@
 /*
  * Copyright (C) 2012 Samsung Electronics. All rights reserved.
+ * Copyright (C) 2019 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -45 +46 @@
         return;
 
-    m_client->didEndColorPicker();
-    m_client = nullptr;
+    if (auto client = std::exchange(m_client, nullptr))
+        client->didEndColorPicker();
 }
 

trunk/Source/WebKit/UIProcess/WebPageProxy.cpp

@@ -5476 +5476 @@
 void WebPageProxy::didEndColorPicker()
 {
-    if (!hasRunningProcess())
-        return;
-
     m_colorPicker = nullptr;
+    if (!hasRunningProcess())
+        return;
+
     m_process->send(Messages::WebPage::DidEndColorPicker(), m_pageID);
 }