Skip to content

GitLab

T
tangled
Commit 6d47f4e6 authored by tkent's avatar tkent Committed by Commit bot
Browse files
Options

SELECT popup: Fix a crash by DOM mutation during opening popup. 

A mutation callback can be called after MutationObserver is disconnected
because MutationRecords are queued.

BUG=617578

Review-Url: https://codereview.chromium.org/2040123002
Cr-Commit-Position: refs/heads/master@{#398244}
parent d17a8937
Hide whitespace changes
Inline Side-by-side
Showing with 19 additions and 0 deletions
third_party/WebKit/LayoutTests/fast/forms/select/menulist-popup-mutation-crash.html 0 → 100644
View file @ 6d47f4e6
<!DOCTYPE html>
<script src="../../../resources/testharness.js"></script>
<script src="../../../resources/testharnessreport.js"></script>
<script src="../resources/picker-common.js"></script>
<select id=select1>
<script>
test(() => {
var select1 = document.getElementById("select1")
openPicker(select1, {});
var div = select1.appendChild(document.createElement("div"))
div.appendChild(document.createElement("optgroup"))
select1.innerText = "";
div.replaceChild(select1, div.lastChild)
}, "No crash even if an internal MutationObserver callback is called after the MutationObserver was diconnected.");
</script>
third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
View file @ 6d47f4e6
...@@ -2015,6 +2015,10 @@ public: ...@@ -2015,6 +2015,10 @@ public:
private: private:
void call(const HeapVector<Member<MutationRecord>>&, MutationObserver*) override void call(const HeapVector<Member<MutationRecord>>&, MutationObserver*) override
{ {
// We disconnect the MutationObserver when a popuup is closed. However
// MutationObserver can call back after disconnection.
if (!m_select->popupIsVisible())
return;
m_select->didMutateSubtree(); m_select->didMutateSubtree();
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment