[Webkit-unassigned] [Bug 73273] New: Crash caused by V8Proxy::retrieveFrameForCallingContext() returning 0 in V8DOMWindowCustom::handlePostMessageCallback
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Mon Nov 28 17:41:14 PST 2011
https://bugs.webkit.org/show_bug.cgi?id=73273
Summary: Crash caused by
V8Proxy::retrieveFrameForCallingContext() returning 0
in V8DOMWindowCustom::handlePostMessageCallback
Product: WebKit
Version: 528+ (Nightly build)
Platform: All
OS/Version: All
Status: NEW
Severity: Normal
Priority: P2
Component: WebCore JavaScript
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: marshall at chromium.org
CC: abarth at webkit.org
1. Create a custom V8 binding that executes another V8 function using the frame context.
2. Call that V8 binding from the body onunload event.
In some cases V8Proxy::retrieveFrameForCallingContext() will return 0 causing the following code in retrieveFrameForCallingContext() to crash:
DOMWindow* source = V8Proxy::retrieveFrameForCallingContext()->domWindow();
The 0 result is caused by the "frame->domWindow() == window" check failing in V8Proxy::retrieveFrame() likely due to the context already being detached from the frame.
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list