diff options
| author | ananta@chromium.org <ananta@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-03-03 22:11:19 +0000 |
|---|---|---|
| committer | ananta@chromium.org <ananta@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-03-03 22:11:19 +0000 |
| commit | 045229a7b8efe2d5fde3aa032805aa8c9268c8ba (patch) | |
| tree | 53467d6617e1f3ea79c05cb3f50ac293c05a1b79 /.gitignore | |
| parent | 32da100526eadc7d8f2d97753a48f5917bb17c66 (diff) | |
| download | chromium_src-045229a7b8efe2d5fde3aa032805aa8c9268c8ba.zip chromium_src-045229a7b8efe2d5fde3aa032805aa8c9268c8ba.tar.gz chromium_src-045229a7b8efe2d5fde3aa032805aa8c9268c8ba.tar.bz2 | |
Fix a crash in ChromeFrame which would occur if we clicked both mouse buttons on a link.
The right click would run the TrackPopupMenuEx API which runs a system modal loop and the left click
would cause the current document to be destroyed causing a crash on return while accessing member
variables on a destroyed object.
Fix is to grab a reference on the current active document while handling the context menu event to protect
against us getting destroyed in the context of the TrackPopupMenuEx call.
We also need to NULL check the automation_client_ member in ChromeFramePlugin as this could be detached
from the existing active document and attached to the new active document instance which comes up to
handle the link navigation.
Fixes bug http://code.google.com/p/chromium/issues/detail?id=37220
Bug=37220
Review URL: http://codereview.chromium.org/664009
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@40547 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to '.gitignore')
0 files changed, 0 insertions, 0 deletions