github/electron
1
1
Fork 0
mirror of https://github.com/electron/electron.git synced 2026-04-10 03:01:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: reparenting UAF crash on macOS (#38679)

Browse Source 
Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>
This commit is contained in:
trop[bot]
2023-06-08 13:29:17 -04:00
committed by GitHub
parent 01faeef36a
commit fc241977fe
3 changed files with 36 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
shell/browser/native_window_mac.h
View File

@@ -157,6 +157,7 @@ class NativeWindowMac : public NativeWindow,
bool IsActive() const override;
// Remove the specified child window without closing it.
void RemoveChildWindow(NativeWindow* child) override;
void RemoveChildFromParentWindow(NativeWindow* child);
// Attach child windows, if the window is visible.
void AttachChildren() override;
// Detach window from parent without destroying it.

30
shell/browser/native_window_mac.mm
View File

@@ -388,6 +388,9 @@ void NativeWindowMac::Close() {
return;
}
// Ensure we're detached from the parent window before closing.
RemoveChildFromParentWindow(this);
// If a sheet is attached to the window when we call
// [window_ performClose:nil], the window won't close properly
// even after the user has ended the sheet.
@@ -405,6 +408,8 @@ void NativeWindowMac::Close() {
}
void NativeWindowMac::CloseImmediately() {
RemoveChildFromParentWindow(this);
// Retain the child window before closing it. If the last reference to the
// NSWindow goes away inside -[NSWindow close], then bad stuff can happen.
// See e.g. http://crbug.com/616701.
@@ -598,6 +603,11 @@ void NativeWindowMac::RemoveChildWindow(NativeWindow* child) {
[window_ removeChildWindow:child->GetNativeWindow().GetNativeNSWindow()];
}
void NativeWindowMac::RemoveChildFromParentWindow(NativeWindow* child) {
if (parent())
parent()->RemoveChildWindow(child);
}
void NativeWindowMac::AttachChildren() {
for (auto* child : child_windows_) {
auto* child_nswindow = child->GetNativeWindow().GetNativeNSWindow();
@@ -1781,27 +1791,27 @@ void NativeWindowMac::InternalSetWindowButtonVisibility(bool visible) {
[[window_ standardWindowButton:NSWindowZoomButton] setHidden:!visible];
}
void NativeWindowMac::InternalSetParentWindow(NativeWindow* parent,
void NativeWindowMac::InternalSetParentWindow(NativeWindow* new_parent,
bool attach) {
if (is_modal())
return;
NativeWindow::SetParentWindow(parent);
// Do not remove/add if we are already properly attached.
if (attach && parent &&
[window_ parentWindow] == parent->GetNativeWindow().GetNativeNSWindow())
if (attach && new_parent &&
[window_ parentWindow] ==
new_parent->GetNativeWindow().GetNativeNSWindow())
return;
// Remove current parent window.
if ([window_ parentWindow])
parent->RemoveChildWindow(this);
RemoveChildFromParentWindow(this);
// Set new parent window.
if (parent && attach) {
parent->add_child_window(this);
parent->AttachChildren();
if (new_parent && attach) {
new_parent->add_child_window(this);
new_parent->AttachChildren();
}
NativeWindow::SetParentWindow(new_parent);
}
void NativeWindowMac::SetForwardMouseMessages(bool forward) {