Title: [269797] branches/safari-610-branch/Source/WebCore
- Revision
- 269797
- Author
- [email protected]
- Date
- 2020-11-13 14:17:17 -0800 (Fri, 13 Nov 2020)
Log Message
Cherry-pick r269321. rdar://problem/71083861
Protect against HTMLMediaElement being destroyed during disptachEvent().
https://bugs.webkit.org/show_bug.cgi?id=218398
<rdar://problem/67613836>
Reviewed by Chris Dumez.
Make the MainThreadGenericEventQueue protect the target as well as the owner of the queue.
Drive-by fix: Create the scoped `eventFiringScope` object after the `protect` object, to ensure
that the member variable set by the first scope will safely occur.
Drive-by fix #2: Also null-check the result of document().page() within HTMLMediaElement::dispatchEvent().
* dom/GenericEventQueue.cpp:
(WebCore::MainThreadGenericEventQueue::dispatchOneEvent):
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::dispatchEvent):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@269321 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Diff
Modified: branches/safari-610-branch/Source/WebCore/ChangeLog (269796 => 269797)
--- branches/safari-610-branch/Source/WebCore/ChangeLog 2020-11-13 22:17:02 UTC (rev 269796)
+++ branches/safari-610-branch/Source/WebCore/ChangeLog 2020-11-13 22:17:17 UTC (rev 269797)
@@ -1,5 +1,49 @@
2020-11-13 Russell Epstein <[email protected]>
+ Cherry-pick r269321. rdar://problem/71083861
+
+ Protect against HTMLMediaElement being destroyed during disptachEvent().
+ https://bugs.webkit.org/show_bug.cgi?id=218398
+ <rdar://problem/67613836>
+
+ Reviewed by Chris Dumez.
+
+ Make the MainThreadGenericEventQueue protect the target as well as the owner of the queue.
+
+ Drive-by fix: Create the scoped `eventFiringScope` object after the `protect` object, to ensure
+ that the member variable set by the first scope will safely occur.
+
+ Drive-by fix #2: Also null-check the result of document().page() within HTMLMediaElement::dispatchEvent().
+
+ * dom/GenericEventQueue.cpp:
+ (WebCore::MainThreadGenericEventQueue::dispatchOneEvent):
+ * html/HTMLMediaElement.cpp:
+ (WebCore::HTMLMediaElement::dispatchEvent):
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@269321 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2020-11-03 Jer Noble <[email protected]>
+
+ Protect against HTMLMediaElement being destroyed during disptachEvent().
+ https://bugs.webkit.org/show_bug.cgi?id=218398
+ <rdar://problem/67613836>
+
+ Reviewed by Chris Dumez.
+
+ Make the MainThreadGenericEventQueue protect the target as well as the owner of the queue.
+
+ Drive-by fix: Create the scoped `eventFiringScope` object after the `protect` object, to ensure
+ that the member variable set by the first scope will safely occur.
+
+ Drive-by fix #2: Also null-check the result of document().page() within HTMLMediaElement::dispatchEvent().
+
+ * dom/GenericEventQueue.cpp:
+ (WebCore::MainThreadGenericEventQueue::dispatchOneEvent):
+ * html/HTMLMediaElement.cpp:
+ (WebCore::HTMLMediaElement::dispatchEvent):
+
+2020-11-13 Russell Epstein <[email protected]>
+
Cherry-pick r269208. rdar://problem/71378171
AX: Incorrect list of voices being displayed on iOS
Modified: branches/safari-610-branch/Source/WebCore/dom/GenericEventQueue.cpp (269796 => 269797)
--- branches/safari-610-branch/Source/WebCore/dom/GenericEventQueue.cpp 2020-11-13 22:17:02 UTC (rev 269796)
+++ branches/safari-610-branch/Source/WebCore/dom/GenericEventQueue.cpp 2020-11-13 22:17:17 UTC (rev 269797)
@@ -64,15 +64,15 @@
{
ASSERT(!m_pendingEvents.isEmpty());
+ Ref<EventTarget> protect(m_owner);
SetForScope<bool> eventFiringScope(m_isFiringEvent, true);
- Ref<EventTarget> protect(m_owner);
RefPtr<Event> event = m_pendingEvents.takeFirst();
- EventTarget& target = event->target() ? *event->target() : m_owner;
- ASSERT_WITH_MESSAGE(!target.scriptExecutionContext()->activeDOMObjectsAreStopped(),
+ Ref<EventTarget> target = event->target() ? *event->target() : m_owner;
+ ASSERT_WITH_MESSAGE(!target->scriptExecutionContext()->activeDOMObjectsAreStopped(),
"An attempt to dispatch an event on a stopped target by EventTargetInterface=%d (nodeName=%s target=%p owner=%p)",
- m_owner.eventTargetInterface(), m_owner.isNode() ? static_cast<Node&>(m_owner).nodeName().ascii().data() : "", &target, &m_owner);
- target.dispatchEvent(*event);
+ m_owner.eventTargetInterface(), m_owner.isNode() ? static_cast<Node&>(m_owner).nodeName().ascii().data() : "", target.ptr(), &m_owner);
+ target->dispatchEvent(*event);
}
void MainThreadGenericEventQueue::close()
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
