Title: [290878] trunk/Source/WebCore
- Revision
- 290878
- Author
- [email protected]
- Date
- 2022-03-07 02:17:57 -0800 (Mon, 07 Mar 2022)
Log Message
Release_Assert | WebCore::Document::addTopLayerElement()
https://bugs.webkit.org/show_bug.cgi?id=237307
Patch by Frédéric Wang <[email protected]> on 2022-03-07
Reviewed by Chris Dumez.
setBooleanAttribute() call in HTMLDialogElement::showModal() dispatches a DOMSubtreeModified
event. Postpone it so that listeners cannot disconnect the dialog element.
* html/HTMLDialogElement.cpp:
(WebCore::HTMLDialogElement::showModal): Add a queue to postpone event.
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (290877 => 290878)
--- trunk/Source/WebCore/ChangeLog 2022-03-07 06:43:16 UTC (rev 290877)
+++ trunk/Source/WebCore/ChangeLog 2022-03-07 10:17:57 UTC (rev 290878)
@@ -1,3 +1,16 @@
+2022-03-07 Frédéric Wang <[email protected]>
+
+ Release_Assert | WebCore::Document::addTopLayerElement()
+ https://bugs.webkit.org/show_bug.cgi?id=237307
+
+ Reviewed by Chris Dumez.
+
+ setBooleanAttribute() call in HTMLDialogElement::showModal() dispatches a DOMSubtreeModified
+ event. Postpone it so that listeners cannot disconnect the dialog element.
+
+ * html/HTMLDialogElement.cpp:
+ (WebCore::HTMLDialogElement::showModal): Add a queue to postpone event.
+
2022-03-06 Eric Carlson <[email protected]>
Push HTMLMediaElement renderer's contentBox rect to GPU process
Modified: trunk/Source/WebCore/html/HTMLDialogElement.cpp (290877 => 290878)
--- trunk/Source/WebCore/html/HTMLDialogElement.cpp 2022-03-07 06:43:16 UTC (rev 290877)
+++ trunk/Source/WebCore/html/HTMLDialogElement.cpp 2022-03-07 10:17:57 UTC (rev 290878)
@@ -33,6 +33,7 @@
#include "GCReachableRef.h"
#include "HTMLNames.h"
#include "RenderElement.h"
+#include "ScopedEventQueue.h"
#include "TypedElementDescendantIterator.h"
#include <wtf/IsoMallocInlines.h>
@@ -70,6 +71,9 @@
if (!isConnected())
return Exception { InvalidStateError };
+ // setBooleanAttribute will dispatch a DOMSubtreeModified event.
+ // Postpone callback execution that can potentially make the dialog disconnected.
+ EventQueueScope scope;
setBooleanAttribute(openAttr, true);
m_isModal = true;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
