Changeset 269797 in webkit

Timestamp:

Nov 13, 2020, 2:17:17 PM (6 years ago)

Author:

Russell Epstein

Message:

Cherry-pick r269321. rdar://problem/71083861

Protect against HTMLMediaElement being destroyed during disptachEvent().
​https://bugs.webkit.org/show_bug.cgi?id=218398
<rdar://problem/67613836>

Reviewed by Chris Dumez.

Make the MainThreadGenericEventQueue protect the target as well as the owner of the queue.

Drive-by fix: Create the scoped eventFiringScope object after the protect object, to ensure
that the member variable set by the first scope will safely occur.

Drive-by fix #2: Also null-check the result of document().page() within HTMLMediaElement::dispatchEvent().

• dom/GenericEventQueue.cpp: (WebCore::MainThreadGenericEventQueue::dispatchOneEvent):
• html/HTMLMediaElement.cpp: (WebCore::HTMLMediaElement::dispatchEvent):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@269321 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-610-branch/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• dom/GenericEventQueue.cpp (modified) (1 diff)

branches/safari-610-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2020-11-13  Russell Epstein  <repstein@apple.com>
+
+        Cherry-pick r269321. rdar://problem/71083861
+
+    Protect against HTMLMediaElement being destroyed during disptachEvent().
+    https://bugs.webkit.org/show_bug.cgi?id=218398
+    <rdar://problem/67613836>
+    
+    Reviewed by Chris Dumez.
+    
+    Make the MainThreadGenericEventQueue protect the target as well as the owner of the queue.
+    
+    Drive-by fix: Create the scoped `eventFiringScope` object after the `protect` object, to ensure
+    that the member variable set by the first scope will safely occur.
+    
+    Drive-by fix #2: Also null-check the result of document().page() within HTMLMediaElement::dispatchEvent().
+    
+    * dom/GenericEventQueue.cpp:
+    (WebCore::MainThreadGenericEventQueue::dispatchOneEvent):
+    * html/HTMLMediaElement.cpp:
+    (WebCore::HTMLMediaElement::dispatchEvent):
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@269321 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2020-11-03  Jer Noble  <jer.noble@apple.com>
+
+            Protect against HTMLMediaElement being destroyed during disptachEvent().
+            https://bugs.webkit.org/show_bug.cgi?id=218398
+            <rdar://problem/67613836>
+
+            Reviewed by Chris Dumez.
+
+            Make the MainThreadGenericEventQueue protect the target as well as the owner of the queue.
+
+            Drive-by fix: Create the scoped `eventFiringScope` object after the `protect` object, to ensure
+            that the member variable set by the first scope will safely occur.
+
+            Drive-by fix #2: Also null-check the result of document().page() within HTMLMediaElement::dispatchEvent().
+
+            * dom/GenericEventQueue.cpp:
+            (WebCore::MainThreadGenericEventQueue::dispatchOneEvent):
+            * html/HTMLMediaElement.cpp:
+            (WebCore::HTMLMediaElement::dispatchEvent):
+
 2020-11-13  Russell Epstein  <repstein@apple.com>
 

branches/safari-610-branch/Source/WebCore/dom/GenericEventQueue.cpp

@@ -65 +65 @@
     ASSERT(!m_pendingEvents.isEmpty());
 
+    Ref<EventTarget> protect(m_owner);
     SetForScope<bool> eventFiringScope(m_isFiringEvent, true);
-    Ref<EventTarget> protect(m_owner);
 
     RefPtr<Event> event = m_pendingEvents.takeFirst();
-    EventTarget& target = event->target() ? *event->target() : m_owner;
-    ASSERT_WITH_MESSAGE(!target.scriptExecutionContext()->activeDOMObjectsAreStopped(),
+    Ref<EventTarget> target = event->target() ? *event->target() : m_owner;
+    ASSERT_WITH_MESSAGE(!target->scriptExecutionContext()->activeDOMObjectsAreStopped(),
         "An attempt to dispatch an event on a stopped target by EventTargetInterface=%d (nodeName=%s target=%p owner=%p)",
-        m_owner.eventTargetInterface(), m_owner.isNode() ? static_cast<Node&>(m_owner).nodeName().ascii().data() : "", &target, &m_owner);
-    target.dispatchEvent(*event);
+        m_owner.eventTargetInterface(), m_owner.isNode() ? static_cast<Node&>(m_owner).nodeName().ascii().data() : "", target.ptr(), &m_owner);
+    target->dispatchEvent(*event);
 }