diff options
| author | gsennton <gsennton@chromium.org> | 2015-08-12 06:03:57 -0700 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2015-08-12 13:04:31 +0000 |
| commit | fbcead00c43e9206a225312e794868da70e9290a (patch) | |
| tree | e9947ff5c7603295ceb22732b647692708f0da93 /android_webview | |
| parent | 243b94b81c7a01c3ed72e4d0f96a66a4dcab1fdb (diff) | |
| download | chromium_src-fbcead00c43e9206a225312e794868da70e9290a.zip chromium_src-fbcead00c43e9206a225312e794868da70e9290a.tar.gz chromium_src-fbcead00c43e9206a225312e794868da70e9290a.tar.bz2 | |
Ensure that we do not receive callbacks after destroying WebView
An app that calls destroy() on a WebView for which a callback is pending
(e.g. onPageFinished) can accidentically use the WebView from that
callback after the destroy method has finished.
To prevent this from happening we now reset the WebView callback
listeners (e.g. WebViewClient) when destroying WebView.
BUG=498796
Review URL: https://codereview.chromium.org/1284923002
Cr-Commit-Position: refs/heads/master@{#343006}
Diffstat (limited to 'android_webview')
3 files changed, 13 insertions, 0 deletions
diff --git a/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromium.java b/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromium.java index 1ad4d91..97d169f 100644 --- a/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromium.java +++ b/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromium.java @@ -432,6 +432,12 @@ class WebViewChromium implements WebViewProvider, WebViewProvider.ScrollDelegate return; } + // Make sure that we do not trigger any callbacks after destruction + mContentsClientAdapter.setWebChromeClient(null); + mContentsClientAdapter.setWebViewClient(null); + mContentsClientAdapter.setPictureListener(null); + mContentsClientAdapter.setFindListener(null); + mAwContents.destroy(); if (mGLfunctor != null) { mGLfunctor.destroy(); diff --git a/android_webview/java/src/org/chromium/android_webview/AwContents.java b/android_webview/java/src/org/chromium/android_webview/AwContents.java index e56aca1..bdcbd37 100644 --- a/android_webview/java/src/org/chromium/android_webview/AwContents.java +++ b/android_webview/java/src/org/chromium/android_webview/AwContents.java @@ -1058,6 +1058,9 @@ public class AwContents implements SmartClipProvider, if (TRACE) Log.d(TAG, "destroy"); if (isDestroyed()) return; + // Remove pending messages + mContentsClient.getCallbackHelper().removeCallbacksAndMessages(); + if (mPostMessageSender != null) { mBrowserContext.getMessagePortService().removeObserver(mPostMessageSender); mPostMessageSender = null; diff --git a/android_webview/java/src/org/chromium/android_webview/AwContentsClientCallbackHelper.java b/android_webview/java/src/org/chromium/android_webview/AwContentsClientCallbackHelper.java index ee15d99..39fc42e 100644 --- a/android_webview/java/src/org/chromium/android_webview/AwContentsClientCallbackHelper.java +++ b/android_webview/java/src/org/chromium/android_webview/AwContentsClientCallbackHelper.java @@ -303,4 +303,8 @@ public class AwContentsClientCallbackHelper { OnFormResubmissionInfo info = new OnFormResubmissionInfo(dontResend, resend); mHandler.sendMessage(mHandler.obtainMessage(MSG_ON_FORM_RESUBMISSION, info)); } + + void removeCallbacksAndMessages() { + mHandler.removeCallbacksAndMessages(null); + } } |