DescriptionFix flaky crash in WebPagePopupImpl::closePopup.
Reentrance to WebViewImpl::closePagePopup is possible. closePopup crashed in
that case because m_page was valid and m_page->mainFrame() was nullptr.
The details:
If WebViewImpl::closePagePopup is called, and the LocalFrame in the page popup
has the last references to the page popup owner Element,
1. WebPagePopupImpl::closePopup() calls destroyPage().
2. destroyPage() calls Page::willBeDestroyed().
3. willBeDestroyed() destructs the LocalFrame.
4. The LocalFrame destructor destructs the owner Element.
5. The owner Element destructor destructs PickerIndicatorElement.
6. PickerIndicatorElement destructor calls WebViewImpl::closePagePopup().
This CL changes WebViewImpl::closePagePopup() so that m_pagePopup is cleared
before calling WebPagePopupImpl::closePopup() to avoid reentrancy to it.
BUG=454043
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=200528
Patch Set 1 #
Messages
Total messages: 8 (2 generated)
|