mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

fix: check for destroyed webcontents in converter (#25431)

Browse source
This commit is contained in:
Jeremy Rose 2020-09-16 12:25:49 -07:00 • committed by GitHub
parent 1ba46a91b6
commit ba55aaa53b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
shell/common/gin_converters/content_converter.cc
View file

@ -237,6 +237,12 @@ v8::Local<v8::Value> Converter<content::WebContents*>::ToV8(
bool Converter<content::WebContents*>::FromV8(v8::Isolate* isolate,
v8::Local<v8::Value> val,
content::WebContents** out) {
if (!val->IsObject())
return false;
// gin's unwrapping converter doesn't expect the pointer inside to ever be
// nullptr, so we check here first before attempting to unwrap.
if (gin_helper::Destroyable::IsDestroyed(val.As<v8::Object>()))
return false;
electron::api::WebContents* web_contents = nullptr;
if (!gin::ConvertFromV8(isolate, val, &web_contents) || !web_contents)
return false;

9
spec-main/fixtures/crash-cases/webview-attach-destroyed/index.js Normal file
View file

@ -0,0 +1,9 @@
const { app, BrowserWindow } = require('electron');
app.whenReady().then(() => {
const w = new BrowserWindow({ show: false, webPreferences: { webviewTag: true } });
w.loadURL('data:text/html,<webview src="data:text/html,hi"></webview>');
app.on('web-contents-created', () => {
w.close();
});
});