Skip to content

GitLab

T
tangled
Commit f1c51755 authored by Nate Chapin's avatar Nate Chapin Committed by Commit Bot
Browse files
Options

Early-exit for detached Document in IntersectionObserver::ComputeIntersectionObservations 

delegate_->GetExecutionContext() can get confused for Element-root
IntersectionObservers if the Element moves between Documents. If the original
Document was detached, attempting to schedule a task for that context will crash.

Bug: 763040
Test: intersection-observer/observer-shared-from-iframe.html
Change-Id: I6315791b71bf1e3d02e0e6f7369992f2c6fe2a6c
Reviewed-on: https://chromium-review.googlesource.com/716671Reviewed-by: default avatarStefan Zager <szager@chromium.org>
Commit-Queue: Nate Chapin <japhet@chromium.org>
Cr-Commit-Position: refs/heads/master@{#509604}
parent d99555d6
Hide whitespace changes
Inline Side-by-side
Showing with 32 additions and 1 deletion
third_party/WebKit/LayoutTests/intersection-observer/observer-shared-from-iframe.html 0 → 100644
View file @ f1c51755
<body>
PASS if no crash.
<iframe id="i" src="resources/iframe-that-shares-observer.html"></iframe>
<script>
if (window.testRunner) {
testRunner.waitUntilDone();
testRunner.dumpAsText();
}
function move(d) {
document.body.appendChild(d);
i.remove();
setTimeout(function() {
if (window.testRunner)
testRunner.notifyDone();
}, 0);
}
</script>
</body>
third_party/WebKit/LayoutTests/intersection-observer/resources/iframe-that-shares-observer.html 0 → 100644
View file @ f1c51755
<body>
<div id="root">
<div id="child"></div>
</div>
<script>
var o = new IntersectionObserver(function(){}, {root: root});
o.observe(child);
parent.move(root);
</script>
</body>
third_party/WebKit/Source/core/intersection_observer/IntersectionObserver.cpp
View file @ f1c51755
......@@ -282,7 +282,7 @@ void IntersectionObserver::ComputeIntersectionObservations() {
if (!RootIsValid())
return;
Document* delegate_document = ToDocument(delegate_->GetExecutionContext());
if (!delegate_document)
if (!delegate_document || delegate_document->IsStopped())
return;
LocalDOMWindow* delegate_dom_window = delegate_document->domWindow();
if (!delegate_dom_window)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment