Chromium Code Reviews Chromium Code Reviews
Issue
314603002:
Ensure that in-process plugins can't destroy themselves by closing a URLLoader (Closed)
DescriptionEnsure that in-process plugins can't destroy themselves by closing a URLLoader
Previously in-process plugins could close the main URLLoader, which could result
destruction of themselves. This only happens in-process because calling
URLLoader.Close() results in synchronously calling in to blink, whereas the
call is asynchronous due to IPC when OOP.
This is fixed here by adding a hack to the in-process router. We should probably
post every message to the message loop, but there is a chance this might break
something and we will be removing in-process plugins altogether soon.
There are also two other related bugs this fixes:
1) The PepperPluginInstanceImpl::DidDataFromWebURLResponse could be called
after PepperPluginInstanceImpl::Delete() has been run, in which case the
plugin instance may also be destroyed, so we should not run HandleDocumentLoad
in that case.
2) The instance may be destroyed before the PepperURLLoaderHost so we need
to check if it is null.
BUG=372548
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=274770
Patch Set 1 #
Total comments: 2
Patch Set 2 : #
Messages
Total messages: 6 (0 generated)
|
|||||||||||||||||||||||||||||||||||||
