| commit | c366aaba318fa8badb81e77c677494121643a0c8 | |
| author | yzshen@chromium.org <yzshen@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | |
| Thu, 9 May 2013 12:50:27 +0000 (9 12:50 +0000) | ||
| committer | yzshen@chromium.org <yzshen@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | |
| Thu, 9 May 2013 12:50:27 +0000 (9 12:50 +0000) | ||
| tree | 69fdd1b5e1dec54b0ee76328ceccd4eb13241611 | treesnapshot (tar.gz zip) |
| parent | 28526a10ae14c9abe740322af25029d2a3d85d40 | commitdiff |
Fix the problem of having a dangling layer_ pointer in RenderWidgetFullscreenPepper in some cases.
When PluginInstance calls Destroy() on fullscreen_container_ and resets the pointer, the corresponding RenderWidgetFullscreenPepper instance will post itself a Close message and live until that is processed. Before it actually goes away, if PluginInstance::UpdateLayer() is called, we may destroy web_layer_ without notifying the soon-to-die RenderWidgetFullscreenPepper instance to reset its layer_ pointer (because we have reset the pointer to it). This will result in a crash if a Resize message is processed before Close.
BUG=236473
TEST=None
Review URL: https://chromiumcodereview.appspot.com/14960005
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@199200 0039d316-1c4b-4281-b951-d872f2087c98
When PluginInstance calls Destroy() on fullscreen_container_ and resets the pointer, the corresponding RenderWidgetFullscreenPepper instance will post itself a Close message and live until that is processed. Before it actually goes away, if PluginInstance::UpdateLayer() is called, we may destroy web_layer_ without notifying the soon-to-die RenderWidgetFullscreenPepper instance to reset its layer_ pointer (because we have reset the pointer to it). This will result in a crash if a Resize message is processed before Close.
BUG=236473
TEST=None
Review URL: https://chromiumcodereview.appspot.com/14960005
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@199200 0039d316-1c4b-4281-b951-d872f2087c98
| content/renderer/render_widget_fullscreen_pepper.cc | diffblobblamehistory |