[Webkit-unassigned] [Bug 44485] New: consider forcing callers of FocusController::setFocusedNode to hold a ref to |node|

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=44485

           Summary: consider forcing callers of
                    FocusController::setFocusedNode to hold a ref to
                    |node|
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebKit Misc.
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: tony at chromium.org
                CC: abarth at webkit.org


It's possible for the node passed into setFocusedNode to be deleted after the method exits.  This can happen if a focus or change event handler runs and deletes the DOM node we're trying to focus.  If callers of FocusController::setFocusedNode are not careful, they can used the deleted node.

To avoid accidental crashes, Adam suggested making sure that callers of setFocusedNode hold a ref to |node|.  I originally thought we could do this by making sure the ref at the end of the method is > 0, but this is a runtime check and won't actually catch bad callers unless a test case is contrived.  Hmm, I'm not sure there's an easy way to force this . . .

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.