Title: [277375] trunk/Source/WebKit
Revision
277375
Author
[email protected]
Date
2021-05-12 10:46:26 -0700 (Wed, 12 May 2021)

Log Message

Crash in WebPageProxy::endColorPicker()
https://bugs.webkit.org/show_bug.cgi?id=225679

Patch by Julian Gonzalez <[email protected]> on 2021-05-12
Reviewed by Ryosuke Niwa.

Make sure that endColorPicker() and didEndColorPicker()
do not both attempt to null-out m_colorPicker.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::endColorPicker):
(WebKit::WebPageProxy::didEndColorPicker):

Modified Paths

Diff

Modified: trunk/Source/WebKit/ChangeLog (277374 => 277375)


--- trunk/Source/WebKit/ChangeLog	2021-05-12 17:44:36 UTC (rev 277374)
+++ trunk/Source/WebKit/ChangeLog	2021-05-12 17:46:26 UTC (rev 277375)
@@ -1,3 +1,17 @@
+2021-05-12  Julian Gonzalez  <[email protected]>
+
+        Crash in WebPageProxy::endColorPicker()
+        https://bugs.webkit.org/show_bug.cgi?id=225679
+
+        Reviewed by Ryosuke Niwa.
+
+        Make sure that endColorPicker() and didEndColorPicker()
+        do not both attempt to null-out m_colorPicker.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::endColorPicker):
+        (WebKit::WebPageProxy::didEndColorPicker):
+
 2021-05-12  Peng Liu  <[email protected]>
 
         Implement TextTrackPrivateRemote::inBandMetadataTrackDispatchType()

Modified: trunk/Source/WebKit/UIProcess/WebPageProxy.cpp (277374 => 277375)


--- trunk/Source/WebKit/UIProcess/WebPageProxy.cpp	2021-05-12 17:44:36 UTC (rev 277374)
+++ trunk/Source/WebKit/UIProcess/WebPageProxy.cpp	2021-05-12 17:46:26 UTC (rev 277375)
@@ -6217,10 +6217,8 @@
 
 void WebPageProxy::endColorPicker()
 {
-    if (!m_colorPicker)
-        return;
-
-    m_colorPicker->endPicker();
+    if (auto colorPicker = std::exchange(m_colorPicker, nullptr))
+        colorPicker->endPicker();
 }
 
 void WebPageProxy::didChooseColor(const WebCore::Color& color)
@@ -6233,11 +6231,13 @@
 
 void WebPageProxy::didEndColorPicker()
 {
-    m_colorPicker = nullptr;
-    if (!hasRunningProcess())
-        return;
+    if (std::exchange(m_colorPicker, nullptr)) {
+        if (!hasRunningProcess())
+            return;
 
-    send(Messages::WebPage::DidEndColorPicker());
+        send(Messages::WebPage::DidEndColorPicker());
+    }
+
 }
 #endif
 
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to