Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(133)

Unified Diff: Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp

Issue 8028034: Merge 95667 - [Chromium] Protect the Frame in V8HTMLDocument::openCallback (Closed) Base URL: http://svn.webkit.org/repository/webkit/branches/chromium/835/
Patch Set: Created 9 years, 3 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « LayoutTests/fast/dom/frame-deleted-in-document-open-expected.txt ('k') | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
===================================================================
--- Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp (revision 95975)
+++ Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp (working copy)
@@ -132,9 +132,9 @@
HTMLDocument* htmlDocument = V8HTMLDocument::toNative(args.Holder());
if (args.Length() > 2) {
- if (Frame* frame = htmlDocument->frame()) {
+ if (RefPtr<Frame> frame = htmlDocument->frame()) {
// Fetch the global object for the frame.
- v8::Local<v8::Context> context = V8Proxy::context(frame);
+ v8::Local<v8::Context> context = V8Proxy::context(frame.get());
// Bail out if we cannot get the context.
if (context.IsEmpty())
return v8::Undefined();
@@ -151,8 +151,9 @@
for (int i = 0; i < args.Length(); i++)
params[i] = args[i];
- V8Proxy* proxy = V8Proxy::retrieve(frame);
- ASSERT(proxy);
+ V8Proxy* proxy = V8Proxy::retrieve(frame.get());
+ if (!proxy)
+ return v8::Undefined();
v8::Local<v8::Value> result = proxy->callFunction(v8::Local<v8::Function>::Cast(function), global, args.Length(), params);
delete[] params;
« no previous file with comments | « LayoutTests/fast/dom/frame-deleted-in-document-open-expected.txt ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698