Title: [185837] trunk/Source/WebKit2
- Revision
- 185837
- Author
- [email protected]
- Date
- 2015-06-22 12:30:46 -0700 (Mon, 22 Jun 2015)
Log Message
Crashes in hit testing under WebPage::acceptsFirstMouse() while handling sync message in plug-in teardown
https://bugs.webkit.org/show_bug.cgi?id=146211
rdar://problem/17180615
Reviewed by Sam Weinig.
If we're inside a sendSync message when we're being called, just bail.
* WebProcess/WebPage/mac/WebPageMac.mm:
(WebKit::WebPage::acceptsFirstMouse):
Modified Paths
Diff
Modified: trunk/Source/WebKit2/ChangeLog (185836 => 185837)
--- trunk/Source/WebKit2/ChangeLog 2015-06-22 17:53:43 UTC (rev 185836)
+++ trunk/Source/WebKit2/ChangeLog 2015-06-22 19:30:46 UTC (rev 185837)
@@ -1,3 +1,16 @@
+2015-06-22 Anders Carlsson <[email protected]>
+
+ Crashes in hit testing under WebPage::acceptsFirstMouse() while handling sync message in plug-in teardown
+ https://bugs.webkit.org/show_bug.cgi?id=146211
+ rdar://problem/17180615
+
+ Reviewed by Sam Weinig.
+
+ If we're inside a sendSync message when we're being called, just bail.
+
+ * WebProcess/WebPage/mac/WebPageMac.mm:
+ (WebKit::WebPage::acceptsFirstMouse):
+
2015-06-22 Dan Bernstein <[email protected]>
Part 1 of [Xcode] Fold the WebKit2SandboxProfiles-IOSOverride target into the Sandbox Profiles target
Modified: trunk/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm (185836 => 185837)
--- trunk/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm 2015-06-22 17:53:43 UTC (rev 185836)
+++ trunk/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm 2015-06-22 19:30:46 UTC (rev 185837)
@@ -843,6 +843,13 @@
void WebPage::acceptsFirstMouse(int eventNumber, const WebKit::WebMouseEvent& event, bool& result)
{
result = false;
+
+ if (WebProcess::singleton().parentProcessConnection()->inSendSync()) {
+ // In case we're already inside a sendSync message, it's possible that the page is in a
+ // transitionary state, so any hit-testing could cause crashes so we just return early in that case.
+ return;
+ }
+
Frame& frame = m_page->focusController().focusedOrMainFrame();
HitTestResult hitResult = frame.eventHandler().hitTestResultAtPoint(frame.view()->windowToContents(event.position()), HitTestRequest::ReadOnly | HitTestRequest::Active);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
