fix: heap-use-after-free in tray.popUpContextMenu (#22842)

This commit is contained in:
Jeremy Apthorp 2020-03-26 18:30:21 -07:00 committed by GitHub
parent 8ff7a1160a
commit ac501e8194
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 15 additions and 0 deletions

View file

@ -181,8 +181,16 @@
useDefaultAccelerator:NO]);
// Hacky way to mimic design of ordinary tray menu.
[statusItem_ setMenu:[menuController menu]];
// -performClick: is a blocking call, which will run the task loop inside
// itself. This can potentially include running JS, which can result in
// this object being released. We take a temporary reference here to make
// sure we stay alive long enough to successfully return from this
// function.
// TODO(nornagon/codebytere): Avoid nesting task loops here.
[self retain];
[[statusItem_ button] performClick:self];
[statusItem_ setMenu:[menuController_ menu]];
[self release];
return;
}