| commit | 30cd72d13173112edf78b2204bbdda72fc37754b | [log] [tgz] |
|---|---|---|
| author | danakj <[email protected]> | Fri Oct 11 17:52:50 2019 |
| committer | Commit Bot <[email protected]> | Fri Oct 11 17:52:50 2019 |
| tree | 2dbbd3d37720f67b3db844370a1d9f980a638e9d | |
| parent | 15651c032b3ef38d460b86e884b3e43457646e24 [diff] |
Remove null checks and early outs for closing in RenderWidget. RenderWidget used to start closing and then post a task to self-delete. But now it deletes synchronously inside Close(). So when closing_ becomes true, the RenderWidget will be deleted in the same stack. Thus we do not need to guard against closing_ since blink will not be using the RenderWidget afterward - it would be a UAF. The LayerTreeViewDelegate methods used to check for a null WebWidget which would be the case once closing_ became true, before RenderWidget was destroyed. Now the RenderWidget disconnects itself from the LayerTreeView and deletes immediately, so these methods are never called with a null WebWidget unless they were used while the RenderWidget is undead. But the compositor does not run while the RenderWidget is undead, and the LayerTreeViewDelegate will not be used unless the compositor posted the task and then runs it after the RenderWidget becomes undead. The methods in this CL are all part of the BeginMainFrame step which only runs when the compositor is visible and the RenderWidget is not undead. [email protected] Bug: 419087 Change-Id: If0158f2ffeaf0c5d334a80aed3cdb9e686002fb6 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1854878 Reviewed-by: Avi Drissman <[email protected]> Commit-Queue: danakj <[email protected]> Cr-Commit-Position: refs/heads/master@{#705178}
ChromiumChromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.
The project's web site is https://www.chromium.org.
Documentation in the source is rooted in docs/README.md.
Learn how to Get Around the Chromium Source Code Directory Structure .