Bug 62332

Summary: [WKView _setDragImage:at:linkDrag:] can crash if WKView is dealloc'ed during drag
Product: WebKit Reporter: John Sullivan <sullivan>
Component: WebKit2Assignee: John Sullivan <sullivan>
Status: RESOLVED FIXED    
Severity: Major Keywords: InRadar
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Mac   
OS: All   
Attachments:
Description Flags
Patch to retain self during this method darin: review+

John Sullivan
Reported 2011-06-08 15:15:23 PDT
[WKView _setDragImage:at:linkDrag:] contains a call to super that performs a drag. It's possible for this call to super to end up dealloc'ing self, and then WebKit will crash on the line of code that runs after the call to [super dragImage::::::]. This is in Radar as 9355199
Attachments
Patch to retain self during this method (1.26 KB, patch)
2011-06-08 15:22 PDT, John Sullivan 		darin: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
John Sullivan
Comment 1 2011-06-08 15:22:01 PDT
Created attachment 96492 [details] Patch to retain self during this method
Darin Adler
Comment 2 2011-06-08 15:57:08 PDT
Comment on attachment 96492 [details] Patch to retain self during this method View in context: https://bugs.webkit.org/attachment.cgi?id=96492&action=review > Source/WebKit2/UIProcess/API/mac/WKView.mm:2342 > + RetainPtr<WKView> protect(self); It’s better to use a noun for the name of the local variable. Say, protector, instead of protect.
John Sullivan
Comment 3 2011-06-08 16:00:54 PDT
Will change to "protector". I used "protect" in mimicry of another function in this file. I'll change that one too while I'm in here.
John Sullivan
Comment 4 2011-06-08 16:04:39 PDT
Fixed in <http://trac.webkit.org/changeset/88401>.
Note You need to log in before you can comment on or make changes to this bug.