Changeset 277375 in webkit

Timestamp:

May 12, 2021, 10:46:26 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Crash in WebPageProxy::endColorPicker()
​https://bugs.webkit.org/show_bug.cgi?id=225679

Patch by Julian Gonzalez <​julian_a_gonzalez@apple.com> on 2021-05-12
Reviewed by Ryosuke Niwa.

Make sure that endColorPicker() and didEndColorPicker()
do not both attempt to null-out m_colorPicker.

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::endColorPicker):
(WebKit::WebPageProxy::didEndColorPicker):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/WebPageProxy.cpp (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-05-12  Julian Gonzalez  <julian_a_gonzalez@apple.com>
+
+        Crash in WebPageProxy::endColorPicker()
+        https://bugs.webkit.org/show_bug.cgi?id=225679
+
+        Reviewed by Ryosuke Niwa.
+
+        Make sure that endColorPicker() and didEndColorPicker()
+        do not both attempt to null-out m_colorPicker.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::endColorPicker):
+        (WebKit::WebPageProxy::didEndColorPicker):
+
 2021-05-12  Peng Liu  <peng.liu6@apple.com>
 

trunk/Source/WebKit/UIProcess/WebPageProxy.cpp

@@ -6218 +6218 @@
 void WebPageProxy::endColorPicker()
 {
-    if (!m_colorPicker)
-        return;
-
-    m_colorPicker->endPicker();
+    if (auto colorPicker = std::exchange(m_colorPicker, nullptr))
+        colorPicker->endPicker();
 }
 
@@ -6234 +6232 @@
 void WebPageProxy::didEndColorPicker()
 {
-    m_colorPicker = nullptr;
-    if (!hasRunningProcess())
-        return;
-
-    send(Messages::WebPage::DidEndColorPicker());
+    if (std::exchange(m_colorPicker, nullptr)) {
+        if (!hasRunningProcess())
+            return;
+
+        send(Messages::WebPage::DidEndColorPicker());
+    }
+
 }
 #endif