Skip to content

GitLab

T
tangled
Commit 333be66f authored by sigbjornf@opera.com's avatar sigbjornf@opera.com
Browse files
Options

Gracefully handle property enumeration over deleted plugins. 

R=haraken
BUG=397473

Review URL: https://codereview.chromium.org/476663002

git-svn-id: svn://svn.chromium.org/blink/trunk@180274 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent fa160bf4
Hide whitespace changes
Inline Side-by-side
Showing with 30 additions and 1 deletion
third_party/WebKit/LayoutTests/plugins/plugin-destroyed-enumerate-expected.txt 0 → 100644
View file @ 333be66f
Verify that enumerating the properties of a detached plugin doesn't crash, but throws.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
PASS Object.getOwnPropertyNames(testObject) threw exception ReferenceError: NPObject deleted.
PASS successfullyParsed is true
TEST COMPLETE
third_party/WebKit/LayoutTests/plugins/plugin-destroyed-enumerate.html 0 → 100644
View file @ 333be66f
<!DOCTYPE html>
<script src="../resources/js-test.js"></script>
<embed type="application/x-webkit-test-netscape" id=plugin>
<script>
description("Verify that enumerating the properties of a detached plugin doesn't crash, but throws.");
window.jsTestIsAsync = true;
var testObject;
function runTest() {
testObject = plugin.testObject;
plugin.parentNode.removeChild(plugin);
shouldThrow("Object.getOwnPropertyNames(testObject)");
finishJSTest();
}
window.onload = runTest;
</script>
third_party/WebKit/Source/bindings/core/v8/V8NPObject.cpp
View file @ 333be66f
...@@ -373,8 +373,10 @@ void npObjectPropertyEnumerator(const v8::PropertyCallbackInfo<v8::Array>& info, ...@@ -373,8 +373,10 @@ void npObjectPropertyEnumerator(const v8::PropertyCallbackInfo<v8::Array>& info,
// Verify that our wrapper wasn't using a NPObject which // Verify that our wrapper wasn't using a NPObject which
// has already been deleted. // has already been deleted.
if (!npObject || !_NPN_IsAlive(npObject)) if (!npObject || !_NPN_IsAlive(npObject)) {
V8ThrowException::throwReferenceError("NPObject deleted", info.GetIsolate()); V8ThrowException::throwReferenceError("NPObject deleted", info.GetIsolate());
return;
}
if (NP_CLASS_STRUCT_VERSION_HAS_ENUM(npObject->_class) && npObject->_class->enumerate) { if (NP_CLASS_STRUCT_VERSION_HAS_ENUM(npObject->_class) && npObject->_class->enumerate) {
uint32_t count; uint32_t count;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment