Changeset 196790 in webkit

Timestamp:

Feb 18, 2016 5:13:15 PM (8 years ago)

Author:

Simon Fraser

Message:

Wheel event callback removing the window causes crash in WebCore.
​https://bugs.webkit.org/show_bug.cgi?id=150871

Reviewed by Brent Fulgham.
Source/WebCore:

Null check the FrameView before using it, since the iframe may have been removed
from its parent document inside the event handler.

Test: fast/events/wheel-event-destroys-frame.html

• page/mac/EventHandlerMac.mm:

(WebCore::EventHandler::platformCompleteWheelEvent):

LayoutTests:

• fast/events/wheel-event-destroys-frame-expected.txt: Added.
• fast/events/wheel-event-destroys-frame.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/events/wheel-event-destroys-frame-expected.txt (added)
• LayoutTests/fast/events/wheel-event-destroys-frame.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/page/mac/EventHandlerMac.mm (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2016-02-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Wheel event callback removing the window causes crash in WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=150871
+
+        Reviewed by Brent Fulgham.
+
+        * fast/events/wheel-event-destroys-frame-expected.txt: Added.
+        * fast/events/wheel-event-destroys-frame.html: Added.
+
 2016-02-18  Zalan Bujtas  <zalan@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-02-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Wheel event callback removing the window causes crash in WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=150871
+
+        Reviewed by Brent Fulgham.
+        
+        Null check the FrameView before using it, since the iframe may have been removed
+        from its parent document inside the event handler.
+
+        Test: fast/events/wheel-event-destroys-frame.html
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::platformCompleteWheelEvent):
+
 2016-02-18  Brady Eidson  <beidson@apple.com>
 

trunk/Source/WebCore/page/mac/EventHandlerMac.mm

@@ -1009 +1009 @@
 bool EventHandler::platformCompleteWheelEvent(const PlatformWheelEvent& wheelEvent, ContainerNode* scrollableContainer, ScrollableArea* scrollableArea)
 {
+    FrameView* view = m_frame.view();
     // We do another check on the frame view because the event handler can run JS which results in the frame getting destroyed.
-    ASSERT(m_frame.view());
-    FrameView* view = m_frame.view();
+    if (!view)
+        return false;
 
     ScrollLatchingState* latchingState = m_frame.mainFrame().latchingState();