Changeset 269321 in webkit

Timestamp:

Nov 3, 2020, 11:36:08 AM (6 years ago)

Author:

jer.noble@apple.com

Message:

Protect against HTMLMediaElement being destroyed during disptachEvent().
​https://bugs.webkit.org/show_bug.cgi?id=218398
<rdar://problem/67613836>

Reviewed by Chris Dumez.

Make the MainThreadGenericEventQueue protect the target as well as the owner of the queue.

Drive-by fix: Create the scoped eventFiringScope object after the protect object, to ensure
that the member variable set by the first scope will safely occur.

Drive-by fix #2: Also null-check the result of document().page() within HTMLMediaElement::dispatchEvent().

• dom/GenericEventQueue.cpp:

(WebCore::MainThreadGenericEventQueue::dispatchOneEvent):

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::dispatchEvent):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• dom/GenericEventQueue.cpp (modified) (1 diff)
• html/HTMLMediaElement.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-11-03  Jer Noble  <jer.noble@apple.com>
+
+        Protect against HTMLMediaElement being destroyed during disptachEvent().
+        https://bugs.webkit.org/show_bug.cgi?id=218398
+        <rdar://problem/67613836>
+
+        Reviewed by Chris Dumez.
+
+        Make the MainThreadGenericEventQueue protect the target as well as the owner of the queue.
+
+        Drive-by fix: Create the scoped `eventFiringScope` object after the `protect` object, to ensure
+        that the member variable set by the first scope will safely occur.
+
+        Drive-by fix #2: Also null-check the result of document().page() within HTMLMediaElement::dispatchEvent().
+
+        * dom/GenericEventQueue.cpp:
+        (WebCore::MainThreadGenericEventQueue::dispatchOneEvent):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::dispatchEvent):
+
 2020-11-03  Commit Queue  <commit-queue@webkit.org>
 

trunk/Source/WebCore/dom/GenericEventQueue.cpp

@@ -65 +65 @@
     ASSERT(!m_pendingEvents.isEmpty());
 
+    Ref<EventTarget> protect(m_owner);
     SetForScope<bool> eventFiringScope(m_isFiringEvent, true);
-    Ref<EventTarget> protect(m_owner);
 
     RefPtr<Event> event = m_pendingEvents.takeFirst();
-    EventTarget& target = event->target() ? *event->target() : m_owner;
-    ASSERT_WITH_MESSAGE(!target.scriptExecutionContext()->activeDOMObjectsAreStopped(),
+    Ref<EventTarget> target = event->target() ? *event->target() : m_owner;
+    ASSERT_WITH_MESSAGE(!target->scriptExecutionContext()->activeDOMObjectsAreStopped(),
         "An attempt to dispatch an event on a stopped target by EventTargetInterface=%d (nodeName=%s target=%p owner=%p)",
-        m_owner.eventTargetInterface(), m_owner.isNode() ? static_cast<Node&>(m_owner).nodeName().ascii().data() : "", &target, &m_owner);
-    target.dispatchEvent(*event);
+        m_owner.eventTargetInterface(), m_owner.isNode() ? static_cast<Node&>(m_owner).nodeName().ascii().data() : "", target.ptr(), &m_owner);
+    target->dispatchEvent(*event);
 }
 

trunk/Source/WebCore/html/HTMLMediaElement.cpp

@@ -6020 +6020 @@
 
         setFullscreenMode(VideoFullscreenModeNone);
-        document().page()->chrome().client().exitVideoFullscreenForVideoElement(downcast<HTMLVideoElement>(*this));
+        if (auto* page = document().page())
+            page->chrome().client().exitVideoFullscreenForVideoElement(downcast<HTMLVideoElement>(*this));
     }
 }