New issue
Advanced search Search tips

Issue 643727 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Aug 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Feature



Sign in to add a comment

RenderWidget should not keep reference to the focused PepperPluginInstance

Project Member Reported by ekaramad@chromium.org, Sep 2 2016

Issue description

PepperPluginInstance belongs in RenderFrame and the current instance in RenderWidget was added solely to implement IME. We should refactor this and remove the reference from RenderWidget to avoid potential UaF and life time management issues.
 
Project Member

Comment 1 by bugdroid1@chromium.org, Aug 10 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/22d482ee8d910bb108e9623666cbfb434215fba6

commit 22d482ee8d910bb108e9623666cbfb434215fba6
Author: EhsanK <ekaramad@chromium.org>
Date: Thu Aug 10 17:29:49 2017

Remove RenderWidget::focused_pepper_plugin_

This CL removes the reference to the focused pepper plugin from
RenderWidget. This reference was originally added to RenderWidget
to accommodate enabling IME for OOPIFs (moving the logic from
RenderView to RenderWidget):
https://codereview.chromium.org/2029423003

However, keeping the reference is not ideal and has been a cause of
stability crashes before (https://crbug.com/640733).

This CL will drop the variable in RenderWidget and adds a method which
walks the frame tree to get the focused pepper plugin.

Bug:  643727 
Change-Id: Ieb99811e0e1fc44bf147fc8d024ca3b31e5dfa90
Reviewed-on: https://chromium-review.googlesource.com/599193
Commit-Queue: Ehsan Karamad <ekaramad@chromium.org>
Reviewed-by: Lucas Gadani <lfg@chromium.org>
Reviewed-by: Charlie Reis <creis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#493445}
[modify] https://crrev.com/22d482ee8d910bb108e9623666cbfb434215fba6/content/renderer/render_frame_impl.cc
[modify] https://crrev.com/22d482ee8d910bb108e9623666cbfb434215fba6/content/renderer/render_widget.cc
[modify] https://crrev.com/22d482ee8d910bb108e9623666cbfb434215fba6/content/renderer/render_widget.h

Status: Fixed (was: Available)
Closing the bug per comment #2.

Sign in to add a comment