Chromium Code Reviews| Index: ppapi/tests/test_post_message.cc |
| diff --git a/ppapi/tests/test_post_message.cc b/ppapi/tests/test_post_message.cc |
| index 5413b54f00b759f5fe9ed7889bcd80cffa0c6807..6a415bbd58e9e5e906995ced5c0c743b5e7b827a 100644 |
| --- a/ppapi/tests/test_post_message.cc |
| +++ b/ppapi/tests/test_post_message.cc |
| @@ -172,6 +172,14 @@ TestPostMessage::~TestPostMessage() { |
| bool TestPostMessage::Init() { |
| bool success = CheckTestingInterface(); |
| + // Add a post condition to tests which caches the postMessage function and |
| + // then calls it after the instance is destroyed. The ensures that no UAF |
| + // occurs because the MessageChannel may still be alive after the plugin |
| + // instance is destroyed (it will get garbage collected eventually). |
| + instance_->EvalScript("window.pluginPostMessage = " |
| + "document.getElementById('plugin').postMessage"); |
| + instance_->AddPostCondition("window.pluginPostMessage('') === undefined"); |
|
dmichael (off chromium)
2014/08/28 15:50:35
nit: I think you ought to be able to do this all i
|
| + |
| // Set up a special listener that only responds to a FINISHED_WAITING string. |
| // This is for use by WaitForMessages. |
| std::string js_code; |