Skip to content
Permalink
Browse files
Crash when createPluginInternal ends up destroying the plug-in
https://bugs.webkit.org/show_bug.cgi?id=118397
<rdar://problem/14155051>

Reviewed by Simon Fraser.

Keep the WebProcessConnection object alive while calling createPluginInternal and handle
the IPC connection going away.

* PluginProcess/WebProcessConnection.cpp:
(WebKit::WebProcessConnection::createPluginAsynchronously):

Canonical link: https://commits.webkit.org/136397@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@152403 268f45cc-cd09-0410-ab3c-d52691b4dbfc
  • Loading branch information
Anders Carlsson committed Jul 4, 2013
1 parent a18e6dc commit 5941988ba7d1e51812632dc5feb0091e787305cc
Showing with 24 additions and 0 deletions.
  1. +14 −0 Source/WebKit2/ChangeLog
  2. +10 −0 Source/WebKit2/PluginProcess/WebProcessConnection.cpp
@@ -1,3 +1,17 @@
2013-07-04 Anders Carlsson <andersca@apple.com>

Crash when createPluginInternal ends up destroying the plug-in
https://bugs.webkit.org/show_bug.cgi?id=118397
<rdar://problem/14155051>

Reviewed by Simon Fraser.

Keep the WebProcessConnection object alive while calling createPluginInternal and handle
the IPC connection going away.

* PluginProcess/WebProcessConnection.cpp:
(WebKit::WebProcessConnection::createPluginAsynchronously):

2013-07-03 Gordon Sheridan <gordon_sheridan@apple.com>

Implement mechanism to detect (partially) hidden blocked plugins.
@@ -289,7 +289,17 @@ void WebProcessConnection::createPluginAsynchronously(const PluginCreationParame
// Normally the plug-in process doesn't give its synchronous messages the special flag to allow for that.
// We can force it to do so by incrementing the "DispatchMessageMarkedDispatchWhenWaitingForSyncReply" count.
m_connection->incrementDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount();

// The call to createPluginInternal can potentially cause the plug-in to be destroyed and
// thus free the WebProcessConnection object. Protect it.
RefPtr<WebProcessConnection> protect(this);
createPluginInternal(creationParameters, result, wantsWheelEvents, remoteLayerClientID);

if (!m_connection) {
// createPluginInternal caused the connection to go away.
return;
}

m_connection->decrementDispatchMessageMarkedDispatchWhenWaitingForSyncReplyCount();

// If someone asked for this plug-in synchronously while it was in the middle of being created then we need perform the

0 comments on commit 5941988

Please sign in to comment.