| OLD | NEW |
|---|
| (Empty) | |
| 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. |
| 4 |
| 5 #include "core/dom/MutationObserver.h" |
| 6 |
| 7 #include "core/dom/MutationCallback.h" |
| 8 #include "core/dom/MutationObserverInit.h" |
| 9 #include "core/dom/MutationObserverRegistration.h" |
| 10 #include "core/html/HTMLDocument.h" |
| 11 #include "core/html/HTMLElement.h" |
| 12 #include "testing/gtest/include/gtest/gtest.h" |
| 13 |
| 14 namespace blink { |
| 15 |
| 16 namespace { |
| 17 |
| 18 class EmptyMutationCallback : public MutationCallback { |
| 19 public: |
| 20 explicit EmptyMutationCallback(Document& document) : m_document(document) {} |
| 21 DEFINE_INLINE_VIRTUAL_TRACE() { |
| 22 visitor->trace(m_document); |
| 23 MutationCallback::trace(visitor); |
| 24 } |
| 25 |
| 26 private: |
| 27 void call(const HeapVector<Member<MutationRecord>>&, |
| 28 MutationObserver*) override {} |
| 29 ExecutionContext* getExecutionContext() const override { return m_document; } |
| 30 |
| 31 Member<Document> m_document; |
| 32 }; |
| 33 } |
| 34 |
| 35 TEST(MutationObserverTest, DisconnectCrash) { |
| 36 Persistent<Document> document = HTMLDocument::create(); |
| 37 HTMLElement* root = toHTMLElement(document->createElement("html")); |
| 38 document->appendChild(root); |
| 39 root->setInnerHTML("<head><title>\n</title></head><body></body>"); |
| 40 Node* head = root->firstChild()->firstChild(); |
| 41 DCHECK(head); |
| 42 Persistent<MutationObserver> observer = |
| 43 MutationObserver::create(new EmptyMutationCallback(*document)); |
| 44 MutationObserverInit init; |
| 45 init.setCharacterDataOldValue(false); |
| 46 observer->observe(head, init, ASSERT_NO_EXCEPTION); |
| 47 |
| 48 head->remove(); |
| 49 Persistent<MutationObserverRegistration> registration = |
| 50 observer->m_registrations.begin()->get(); |
| 51 // The following GC will collect |head|, but won't collect a |
| 52 // MutationObserverRegistration for |head|. |
| 53 ThreadState::current()->collectGarbage(BlinkGC::NoHeapPointersOnStack, |
| 54 BlinkGC::GCWithoutSweep, |
| 55 BlinkGC::ForcedGC); |
| 56 observer->disconnect(); |
| 57 // The test passes if disconnect() didn't crash. crbug.com/657613. |
| 58 } |
| 59 |
| 60 } // namespace blink |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 2532003002:
MutationObserver: Fix a null-pointer dereference in MutationObserverRegistration::unregister. (Closed)
