diff options
| author | ananta@chromium.org <ananta@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2008-10-28 21:54:08 +0000 |
|---|---|---|
| committer | ananta@chromium.org <ananta@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2008-10-28 21:54:08 +0000 |
| commit | 241639dd034255478926cf4e7dea7447717220cc (patch) | |
| tree | f195e9e508fb13861020865fff013b4d93c3dd52 /build | |
| parent | 8907d0469ed010147265c95017102d1d976565f3 (diff) | |
| download | chromium_src-241639dd034255478926cf4e7dea7447717220cc.zip chromium_src-241639dd034255478926cf4e7dea7447717220cc.tar.gz chromium_src-241639dd034255478926cf4e7dea7447717220cc.tar.bz2 | |
Proposed fix for http://b/issue?id=1362948, which is a crash in the rendererwhen we invoke the setCursor call on the parent view in WebPluginImpl::handleEvent.
This crash occurs because the plugin is deleted in the context of a mouse down event. This could occur by invoking a javascript function via NPN_Evaluate. On return from the HandleEvent sync call we attempt to retreive the parent frame, which
returns NULL and hence the crash.
The fix is to retreive the parent frameview at the start of the WebPluginImpl::handleMouseEvent function and use it whereever needed.
Added a unit test which deletes the plugin instance in a mousemove event.R=jamBug=1362948
Review URL: http://codereview.chromium.org/8178
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@4094 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'build')
0 files changed, 0 insertions, 0 deletions