Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(145)

Side by Side Diff: Source/core/dom/FullscreenElementStack.cpp

Issue 414303006: Fix use-after-free related to RenderFullScreen (Closed) Base URL: svn://svn.chromium.org/blink/trunk
Patch Set: new deal Created 6 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
1 /* 1 /*
2 * Copyright (C) 1999 Lars Knoll (knoll@kde.org) 2 * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
3 * (C) 1999 Antti Koivisto (koivisto@kde.org) 3 * (C) 1999 Antti Koivisto (koivisto@kde.org)
4 * (C) 2001 Dirk Mueller (mueller@kde.org) 4 * (C) 2001 Dirk Mueller (mueller@kde.org)
5 * (C) 2006 Alexey Proskuryakov (ap@webkit.org) 5 * (C) 2006 Alexey Proskuryakov (ap@webkit.org)
6 * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012 Apple Inc. All r ights reserved. 6 * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012 Apple Inc. All r ights reserved.
7 * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.t orchmobile.com/) 7 * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.t orchmobile.com/)
8 * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies) 8 * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
9 * Copyright (C) 2013 Google Inc. All rights reserved. 9 * Copyright (C) 2013 Google Inc. All rights reserved.
10 * 10 *
(...skipping 109 matching lines...) Expand 10 before | Expand all | Expand 10 after
120 inline Document* FullscreenElementStack::document() 120 inline Document* FullscreenElementStack::document()
121 { 121 {
122 return lifecycleContext(); 122 return lifecycleContext();
123 } 123 }
124 124
125 void FullscreenElementStack::documentWasDetached() 125 void FullscreenElementStack::documentWasDetached()
126 { 126 {
127 m_eventQueue.clear(); 127 m_eventQueue.clear();
128 128
129 if (m_fullScreenRenderer) 129 if (m_fullScreenRenderer)
130 setFullScreenRenderer(0); 130 m_fullScreenRenderer->destroy();
131 131
132 #if ENABLE(OILPAN) 132 #if ENABLE(OILPAN)
133 m_fullScreenElement = nullptr; 133 m_fullScreenElement = nullptr;
134 m_fullScreenElementStack.clear(); 134 m_fullScreenElementStack.clear();
135 #endif 135 #endif
136 136
137 } 137 }
138 138
139 #if !ENABLE(OILPAN) 139 #if !ENABLE(OILPAN)
140 void FullscreenElementStack::documentWasDisposed() 140 void FullscreenElementStack::documentWasDisposed()
(...skipping 327 matching lines...) Expand 10 before | Expand all | Expand 10 after
468 return; 468 return;
469 469
470 if (renderer && m_savedPlaceholderRenderStyle) { 470 if (renderer && m_savedPlaceholderRenderStyle) {
471 renderer->createPlaceholder(m_savedPlaceholderRenderStyle.release(), m_s avedPlaceholderFrameRect); 471 renderer->createPlaceholder(m_savedPlaceholderRenderStyle.release(), m_s avedPlaceholderFrameRect);
472 } else if (renderer && m_fullScreenRenderer && m_fullScreenRenderer->placeho lder()) { 472 } else if (renderer && m_fullScreenRenderer && m_fullScreenRenderer->placeho lder()) {
473 RenderBlock* placeholder = m_fullScreenRenderer->placeholder(); 473 RenderBlock* placeholder = m_fullScreenRenderer->placeholder();
474 renderer->createPlaceholder(RenderStyle::clone(placeholder->style()), pl aceholder->frameRect()); 474 renderer->createPlaceholder(RenderStyle::clone(placeholder->style()), pl aceholder->frameRect());
475 } 475 }
476 476
477 if (m_fullScreenRenderer) 477 if (m_fullScreenRenderer)
478 m_fullScreenRenderer->destroy(); 478 m_fullScreenRenderer->unwrapRenderer();
479 ASSERT(!m_fullScreenRenderer); 479 ASSERT(!m_fullScreenRenderer);
480 480
481 m_fullScreenRenderer = renderer; 481 m_fullScreenRenderer = renderer;
482 } 482 }
483 483
484 void FullscreenElementStack::fullScreenRendererDestroyed() 484 void FullscreenElementStack::fullScreenRendererDestroyed()
485 { 485 {
486 m_fullScreenRenderer = 0; 486 m_fullScreenRenderer = 0;
487 } 487 }
488 488
(...skipping 83 matching lines...) Expand 10 before | Expand all | Expand 10 after
572 572
573 void FullscreenElementStack::trace(Visitor* visitor) 573 void FullscreenElementStack::trace(Visitor* visitor)
574 { 574 {
575 visitor->trace(m_fullScreenElement); 575 visitor->trace(m_fullScreenElement);
576 visitor->trace(m_fullScreenElementStack); 576 visitor->trace(m_fullScreenElementStack);
577 visitor->trace(m_eventQueue); 577 visitor->trace(m_eventQueue);
578 DocumentSupplement::trace(visitor); 578 DocumentSupplement::trace(visitor);
579 } 579 }
580 580
581 } // namespace blink 581 } // namespace blink
OLDNEW
« no previous file with comments | « LayoutTests/fullscreen/full-screen-contentEditable-crash-expected.txt ('k') | Source/core/rendering/RenderFullScreen.cpp » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698