diff options
| author | jochen@chromium.org <jochen@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-07-30 20:32:29 +0000 |
|---|---|---|
| committer | jochen@chromium.org <jochen@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-07-30 20:32:29 +0000 |
| commit | 467414ebee5572911b5bd7b36760a40efbf3f4c7 (patch) | |
| tree | 76a22721d7713b714c03c8fced7a4a5a1aa11766 /content | |
| parent | 4556fc8179fc7f393b53dc164c162a8cf31fcc36 (diff) | |
| download | chromium_src-467414ebee5572911b5bd7b36760a40efbf3f4c7.zip chromium_src-467414ebee5572911b5bd7b36760a40efbf3f4c7.tar.gz chromium_src-467414ebee5572911b5bd7b36760a40efbf3f4c7.tar.bz2 | |
NULL check the RenderProcess in RenderWidget's dtor before using it.
Since the RenderWidget is deleted asynchronously, its dtor might get
called after the RenderProcess was already deleted. However, the
RenderProcess will also clear up the transport DIBs in its destructor,
so it's ok.
BUG=265646
R=piman@chromium.org
Review URL: https://codereview.chromium.org/21156007
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@214431 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'content')
| -rw-r--r-- | content/renderer/render_widget.cc | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/content/renderer/render_widget.cc b/content/renderer/render_widget.cc index 605bae5..060881b 100644 --- a/content/renderer/render_widget.cc +++ b/content/renderer/render_widget.cc @@ -243,7 +243,11 @@ RenderWidget::~RenderWidget() { DCHECK(!webwidget_) << "Leaking our WebWidget!"; STLDeleteElements(&updates_pending_swap_); if (current_paint_buf_) { - RenderProcess::current()->ReleaseTransportDIB(current_paint_buf_); + if (RenderProcess::current()) { + // If the RenderProcess is already gone, it will have released all DIBs + // in its destructor anyway. + RenderProcess::current()->ReleaseTransportDIB(current_paint_buf_); + } current_paint_buf_ = NULL; } // If we are swapped out, we have released already. |