Skip to content

GitLab

T
tangled
Commit c10a8f04 authored by myid.o.shin@gmail.com's avatar myid.o.shin@gmail.com
Browse files
Options

Crashed at ImageEventListener::cast & ConditionEventListener::cast. 

Add null checking in EventTarget::removeEventListener,
because we shouldn't be passing in a null listener reference to the ==()operator.

BUG=377425
R=sigbjornf@opera.com

Review URL: https://codereview.chromium.org/539453002

git-svn-id: svn://svn.chromium.org/blink/trunk@181514 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent f1a40023
Hide whitespace changes
Inline Side-by-side
Showing with 46 additions and 0 deletions
third_party/WebKit/LayoutTests/fast/images/image-document-remove-listener-expected.txt 0 → 100644
View file @ c10a8f04
Test that removing invalid event listeners from image documents doesn't crash.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
PASS No crash.
PASS successfullyParsed is true
TEST COMPLETE
third_party/WebKit/LayoutTests/fast/images/image-document-remove-listener.html 0 → 100644
View file @ c10a8f04
<!DOCTYPE html>
<html>
<script src="../../resources/js-test.js"></script>
<body>
<script>
description("Test that removing invalid event listeners from image documents doesn't crash.");
window.jsTestIsAsync = true;
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.setCanOpenWindows();
testRunner.waitUntilDone();
}
function runTest()
{
var newWindow = window.open("resources/dice.png");
newWindow.onload = function() {
newWindow.addEventListener("resize", function () {;});
newWindow.removeEventListener("resize", 2);
testPassed("No crash.");
finishJSTest();
};
}
runTest();
</script>
</body>
</html>
third_party/WebKit/Source/core/events/EventTarget.cpp
View file @ c10a8f04
...@@ -107,6 +107,11 @@ bool EventTarget::addEventListener(const AtomicString& eventType, PassRefPtr<Eve ...@@ -107,6 +107,11 @@ bool EventTarget::addEventListener(const AtomicString& eventType, PassRefPtr<Eve
bool EventTarget::removeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture) bool EventTarget::removeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
{ {
// FIXME: listener null check should throw TypeError (and be done in
// generated bindings), but breaks legacy content. http://crbug.com/249598
if (!listener)
return false;
EventTargetData* d = eventTargetData(); EventTargetData* d = eventTargetData();
if (!d) if (!d)
return false; return false;
......
third_party/WebKit/Source/core/events/RegisteredEventListener.h
View file @ c10a8f04
...@@ -43,6 +43,8 @@ namespace blink { ...@@ -43,6 +43,8 @@ namespace blink {
inline bool operator==(const RegisteredEventListener& a, const RegisteredEventListener& b) inline bool operator==(const RegisteredEventListener& a, const RegisteredEventListener& b)
{ {
ASSERT(a.listener);
ASSERT(b.listener);
return *a.listener == *b.listener && a.useCapture == b.useCapture; return *a.listener == *b.listener && a.useCapture == b.useCapture;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment