Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(387)

Unified Diff: Source/web/WebEmbeddedWorkerImpl.cpp

Issue 449533003: Fix UAF crash bug in WebEmbeddedWorkerImpl. (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master
Patch Set: Edit LayoutTests/LeakExpectations Created 6 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « LayoutTests/LeakExpectations ('k') | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: Source/web/WebEmbeddedWorkerImpl.cpp
diff --git a/Source/web/WebEmbeddedWorkerImpl.cpp b/Source/web/WebEmbeddedWorkerImpl.cpp
index aab92f5f6b072050e8fa9a342b37586dbc147f49..b3f8f36b1bc0eff5a8d86837432b38bcba00da2d 100644
--- a/Source/web/WebEmbeddedWorkerImpl.cpp
+++ b/Source/web/WebEmbeddedWorkerImpl.cpp
@@ -204,8 +204,13 @@ void WebEmbeddedWorkerImpl::terminateWorkerContext()
if (m_askedToTerminate)
return;
m_askedToTerminate = true;
- if (m_mainScriptLoader)
+ if (m_mainScriptLoader) {
m_mainScriptLoader->cancel();
+ m_mainScriptLoader.clear();
+ // This may delete 'this'.
+ m_workerContextClient->workerContextFailedToStart();
+ return;
+ }
if (m_pauseAfterDownloadState == IsPausedAfterDownload) {
// This may delete 'this'.
m_workerContextClient->workerContextFailedToStart();
@@ -337,7 +342,10 @@ void WebEmbeddedWorkerImpl::onScriptLoaderFinished()
{
ASSERT(m_mainScriptLoader);
- if (m_mainScriptLoader->failed() || m_askedToTerminate) {
+ if (m_askedToTerminate)
+ return;
+
+ if (m_mainScriptLoader->failed()) {
m_mainScriptLoader.clear();
// This may delete 'this'.
m_workerContextClient->workerContextFailedToStart();
« no previous file with comments | « LayoutTests/LeakExpectations ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698