diff options
| author | kenrb <kenrb@chromium.org> | 2016-01-27 16:19:36 -0800 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2016-01-28 00:20:58 +0000 |
| commit | 329450ec62f0c6d67a3f842feb17a516721f04d1 (patch) | |
| tree | 2dd20c12126a7783d5d534eb78aadfa92d98fe71 /content/browser | |
| parent | 7193559eb77c7c62e701a822944c3db5fa4b5a06 (diff) | |
| download | chromium_src-329450ec62f0c6d67a3f842feb17a516721f04d1.zip chromium_src-329450ec62f0c6d67a3f842feb17a516721f04d1.tar.gz chromium_src-329450ec62f0c6d67a3f842feb17a516721f04d1.tar.bz2 | |
Clear input event router entries for destroyed RWHVGuests
This is a speculative fix for crashes observed under the
--isolate-extensions trial. A RenderWidgetHostViewGuest currently only
clears its RenderWidgetHostInputEventRouter entry when the BrowserPlugin
is detached. However, there are other paths for destruction that cause
detachment, which might enable it to receive input events after
DestroyGuestView() has been called, potentially leading to the
observed null pointer crashes. This should be avoided by calling
UnregisterSurfaceNamespaceId() before clearing the host_ pointer.
BUG=571092
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_site_isolation
Review URL: https://codereview.chromium.org/1642743002
Cr-Commit-Position: refs/heads/master@{#371924}
Diffstat (limited to 'content/browser')
| -rw-r--r-- | content/browser/frame_host/render_widget_host_view_guest.cc | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/content/browser/frame_host/render_widget_host_view_guest.cc b/content/browser/frame_host/render_widget_host_view_guest.cc index 99a235dc..b3b8d68 100644 --- a/content/browser/frame_host/render_widget_host_view_guest.cc +++ b/content/browser/frame_host/render_widget_host_view_guest.cc @@ -560,6 +560,7 @@ gfx::NativeViewId RenderWidgetHostViewGuest::GetParentForWindowlessPlugin() #endif void RenderWidgetHostViewGuest::DestroyGuestView() { + UnregisterSurfaceNamespaceId(); host_->SetView(NULL); host_ = NULL; base::MessageLoop::current()->DeleteSoon(FROM_HERE, this); |