DescriptionProtect readystatechange event dispatch on XMLHttpRequest.
XMLHttpRequestProgressEventThrottle::dispatchReadyStateChangeEvent may dispatch
multiple events: a deferred progress event and the given ready state change.
Multiple dispatching may lead to a use-after-free bug.
This CL adds a protection for the event target. In addition to that,
XMLHttpRequestProgressEventThrottle stops dispatching the latter event when
dispatching the former event changes the readyState.
BUG=505362
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=197983
Patch Set 1 #
Total comments: 2
Patch Set 2 : #
Messages
Total messages: 8 (3 generated)
|