| Index: ppapi/tests/test_post_message.cc
|
| diff --git a/ppapi/tests/test_post_message.cc b/ppapi/tests/test_post_message.cc
|
| index 5413b54f00b759f5fe9ed7889bcd80cffa0c6807..6a415bbd58e9e5e906995ced5c0c743b5e7b827a 100644
|
| --- a/ppapi/tests/test_post_message.cc
|
| +++ b/ppapi/tests/test_post_message.cc
|
| @@ -172,6 +172,14 @@ TestPostMessage::~TestPostMessage() {
|
| bool TestPostMessage::Init() {
|
| bool success = CheckTestingInterface();
|
|
|
| + // Add a post condition to tests which caches the postMessage function and
|
| + // then calls it after the instance is destroyed. The ensures that no UAF
|
| + // occurs because the MessageChannel may still be alive after the plugin
|
| + // instance is destroyed (it will get garbage collected eventually).
|
| + instance_->EvalScript("window.pluginPostMessage = "
|
| + "document.getElementById('plugin').postMessage");
|
| + instance_->AddPostCondition("window.pluginPostMessage('') === undefined");
|
| +
|
| // Set up a special listener that only responds to a FINISHED_WAITING string.
|
| // This is for use by WaitForMessages.
|
| std::string js_code;
|
|
|