Check for detached frame when creating ImageCapture

An ImageCapture object may be created from an HTMLElement that is part of a context that has already been destroyed. Check to see if the frame has been detached before trying to access the interface provider. Bug: 749499 Change-Id: I25838392413b218212fe2cb16a119d4379bea659 Reviewed-on: https://chromium-review.googlesource.com/592649Reviewed-by: Kentaro Hara <haraken@chromium.org> Commit-Queue: Reilly Grant <reillyg@chromium.org> Cr-Commit-Position: refs/heads/master@{#491233}

Check for detached frame when creating ImageCapture
An ImageCapture object may be created from an HTMLElement that is part of a context that has already been destroyed. Check to see if the frame has been detached before trying to access the interface provider. Bug: 749499 Change-Id: I25838392413b218212fe2cb16a119d4379bea659 Reviewed-on: https://chromium-review.googlesource.com/592649Reviewed-by: Kentaro Hara <haraken@chromium.org> Commit-Queue: Reilly Grant <reillyg@chromium.org> Cr-Commit-Position: refs/heads/master@{#491233}
88d43ade · Reilly Grant · Commit Bot · 53a4df1f · 88d43ade · 88d43ade
Commit 88d43ade authored Aug 02, 2017 by Reilly Grant Committed by Commit Bot Aug 02, 2017
2 changed files
--- a/third_party/WebKit/LayoutTests/imagecapture/detached-HTMLCanvasElement.html
+++ b/third_party/WebKit/LayoutTests/imagecapture/detached-HTMLCanvasElement.html
+<!DOCTYPE html>
+<script src="../resources/testharness.js"></script>
+<script src="../resources/testharnessreport.js"></script>
+<body>
+<script>
+
+async_test(t => {
+  let iframe = document.createElement('iframe');
+  let html = "<canvas id='canvas' width=10 height=10 />";
+  iframe.src = 'data:text/html;charset=utf-8,' + encodeURI(html);
+  iframe.onload = t.step_func_done(() => {
+    // This detaches the frame while retaining a reference to an
+    // HTMLCanvasElement from it.
+    let canvas = iframe.contentWindow.document.getElementById('canvas');
+    document.body.removeChild(iframe);
+
+    // Creation of the ImageCapture object (as part of the MediaStreamTrack)
+    // should be safe even if the frame is detached.
+    canvas.captureStream();
+  });
+
+  document.body.appendChild(iframe);
+}, 'MediaStreamTrack can be obtained from a detached frame');
+
+</script>
+</body>
--- a/third_party/WebKit/Source/modules/imagecapture/ImageCapture.cpp
+++ b/third_party/WebKit/Source/modules/imagecapture/ImageCapture.cpp
@@ -624,6 +624,11 @@ ImageCapture::ImageCapture(ExecutionContext* context, MediaStreamTrack* track)
  DCHECK(stream_track_);
  DCHECK(!service_.is_bound());

+  // This object may be constructed over an ExecutionContext that has already
+  // been detached. In this case the ImageCapture service will not be available.
+  if (!GetFrame())
+    return;
+
  GetFrame()->GetInterfaceProvider().GetInterface(mojo::MakeRequest(&service_));

  service_.set_connection_error_handler(ConvertToBaseCallback(WTF::Bind(