Changeset 88647 in webkit
- Timestamp:
- Jun 13, 2011 10:24:10 AM (13 years ago)
- Location:
- trunk/Source/WebKit2
- Files:
-
- 2 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/Source/WebKit2/ChangeLog
r88646 r88647 1 2011-06-13 Anders Carlsson <andersca@apple.com> 2 3 Reviewed by Dan Bernstein. 4 5 Don't access freed memory in the UI process when a plug-in process crashes 6 https://bugs.webkit.org/show_bug.cgi?id=62548 7 8 Call pluginProcessCrashedOrFailedToLaunch after sending messages to all processes about the plug-in crash, 9 otherwise we'll try to dereference m_pluginInfo.path after the PluginProcessProxy object has been deleted. 10 11 * UIProcess/Plugins/PluginProcessProxy.cpp: 12 (WebKit::PluginProcessProxy::didClose): 13 1 14 2011-06-13 Carlos Garcia Campos <cgarcia@igalia.com> 2 15 -
trunk/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp
r85569 r88647 168 168 #endif 169 169 170 pluginProcessCrashedOrFailedToLaunch();171 172 170 const Vector<WebContext*>& contexts = WebContext::allContexts(); 173 171 for (size_t i = 0; i < contexts.size(); ++i) 174 172 contexts[i]->sendToAllProcesses(Messages::WebProcess::PluginProcessCrashed(m_pluginInfo.path)); 173 174 // This will cause us to be deleted. 175 pluginProcessCrashedOrFailedToLaunch(); 175 176 } 176 177
Note: See TracChangeset
for help on using the changeset viewer.