Changeset 141357 in webkit

Timestamp:

Jan 30, 2013 6:15:03 PM (11 years ago)

Author:

leviw@chromium.org

Message:

[Chromium] WebPluginContainerImpl adding imbalanced touch handler refs
​https://bugs.webkit.org/show_bug.cgi?id=108381

Reviewed by James Robinson.

Source/WebKit/chromium:

WebPluginContainerImpl would call Document::didAddTouchEventHandler every time the plugin requested
touch events. Some plugins make this request more than once, leading to an imbalance in Document's
touch event handler map, and a stale node pointer when the plugin is destroyed. This change
has WebPluginContainerImpl only add one ref for the plugin at a time.

• src/WebPluginContainerImpl.cpp:

(WebKit::WebPluginContainerImpl::requestTouchEventType):

Tools:

• DumpRenderTree/chromium/TestRunner/src/WebTestPlugin.cpp: Adding an attribute that

tickles the case in WebPluginContainerImpl that imbalanced touch handler refs in Document.

LayoutTests:

• platform/chromium/plugins/re-request-touch-events-crash-expected.txt: Added.
• platform/chromium/plugins/re-request-touch-events-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/platform/chromium/plugins/re-request-touch-events-crash-expected.txt (added)
• LayoutTests/platform/chromium/plugins/re-request-touch-events-crash.html (added)
• Source/WebKit/chromium/ChangeLog (modified) (1 diff)
• Source/WebKit/chromium/src/WebPluginContainerImpl.cpp (modified) (1 diff)
• Tools/ChangeLog (modified) (1 diff)
• Tools/DumpRenderTree/chromium/TestRunner/src/WebTestPlugin.cpp (modified) (5 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-01-30  Levi Weintraub  <leviw@chromium.org>
+
+        [Chromium] WebPluginContainerImpl adding imbalanced touch handler refs
+        https://bugs.webkit.org/show_bug.cgi?id=108381
+
+        Reviewed by James Robinson.
+
+        * platform/chromium/plugins/re-request-touch-events-crash-expected.txt: Added.
+        * platform/chromium/plugins/re-request-touch-events-crash.html: Added.
+
 2013-01-30  Rouslan Solomakhin  <rouslan@chromium.org>
 

trunk/Source/WebKit/chromium/ChangeLog

@@ +1 @@
+2013-01-30  Levi Weintraub  <leviw@chromium.org>
+
+        [Chromium] WebPluginContainerImpl adding imbalanced touch handler refs
+        https://bugs.webkit.org/show_bug.cgi?id=108381
+
+        Reviewed by James Robinson.
+
+        WebPluginContainerImpl would call Document::didAddTouchEventHandler every time the plugin requested
+        touch events. Some plugins make this request more than once, leading to an imbalance in Document's
+        touch event handler map, and a stale node pointer when the plugin is destroyed. This change
+        has WebPluginContainerImpl only add one ref for the plugin at a time.
+
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::requestTouchEventType):
+
 2013-01-30  Yusuf Ozuysal  <yusufo@google.com>
 

trunk/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp

@@ -474 +474 @@
     if (m_touchEventRequestType == requestType)
         return;
+    
+    if (requestType != TouchEventRequestTypeNone && m_touchEventRequestType == TouchEventRequestTypeNone)
+        m_element->document()->didAddTouchEventHandler(m_element);
+    else if (requestType == TouchEventRequestTypeNone && m_touchEventRequestType != TouchEventRequestTypeNone)
+        m_element->document()->didRemoveTouchEventHandler(m_element);
     m_touchEventRequestType = requestType;
-    if (m_touchEventRequestType != TouchEventRequestTypeNone)
-        m_element->document()->didAddTouchEventHandler(m_element);
-    else
-        m_element->document()->didRemoveTouchEventHandler(m_element);
 }
 

trunk/Tools/ChangeLog

@@ +1 @@
+2013-01-30  Levi Weintraub  <leviw@chromium.org>
+
+        [Chromium] WebPluginContainerImpl adding imbalanced touch handler refs
+        https://bugs.webkit.org/show_bug.cgi?id=108381
+
+        Reviewed by James Robinson.
+
+        * DumpRenderTree/chromium/TestRunner/src/WebTestPlugin.cpp: Adding an attribute that
+        tickles the case in WebPluginContainerImpl that imbalanced touch handler refs in Document.
+
 2013-01-30  Julie Parent  <jparent@chromium.org>
 

trunk/Tools/DumpRenderTree/chromium/TestRunner/src/WebTestPlugin.cpp

@@ -236 +236 @@
 
     WebPluginContainer::TouchEventRequestType m_touchEventRequest;
+    // Requests touch events from the WebPluginContainerImpl multiple times to tickle webkit.org/b/108381
+    bool m_reRequestTouchEvents;
     bool m_printEventDetails;
     bool m_printUserGestureStatus;
@@ -247 +249 @@
     , m_context(0)
     , m_touchEventRequest(WebPluginContainer::TouchEventRequestTypeNone)
+    , m_reRequestTouchEvents(false)
     , m_printEventDetails(false)
     , m_printUserGestureStatus(false)
@@ -256 +259 @@
     static const WebString kAttributeOpacity = WebString::fromUTF8("opacity");
     static const WebString kAttributeAcceptsTouch = WebString::fromUTF8("accepts-touch");
+    static const WebString kAttributeReRequestTouchEvents = WebString::fromUTF8("re-request-touch");
     static const WebString kAttributePrintEventDetails = WebString::fromUTF8("print-event-details");
     static const WebString kAttributeCanProcessDrag = WebString::fromUTF8("can-process-drag");
@@ -276 +280 @@
         else if (attributeName == kAttributeAcceptsTouch)
             m_touchEventRequest = parseTouchEventRequestType(attributeValue);
+        else if (attributeName == kAttributeReRequestTouchEvents)
+            m_reRequestTouchEvents = parseBoolean(attributeValue);
         else if (attributeName == kAttributePrintEventDetails)
             m_printEventDetails = parseBoolean(attributeValue);
@@ -305 +311 @@
     m_container = container;
     m_container->setWebLayer(m_layer->layer());
+    if (m_reRequestTouchEvents) {
+        m_container->requestTouchEventType(WebPluginContainer::TouchEventRequestTypeSynthesizedMouse);
+        m_container->requestTouchEventType(WebPluginContainer::TouchEventRequestTypeRaw);
+    }
     m_container->requestTouchEventType(m_touchEventRequest);
     m_container->setWantsWheelEvents(true);