v8binding: Fixes MutationCallback not to access the empty context.

MutationCallback holds a ScriptState and accesses it assynchronously. So, MutationCallback should check the context if it's alive before the uses. Bug: 738299 Change-Id: Ib16b37b2e90e5ba87117d7c6e1218f9df6d69a41 Reviewed-on: https://chromium-review.googlesource.com/574509 Commit-Queue: Yuki Shiino <[email protected]> Reviewed-by: Kentaro Hara <[email protected]> Cr-Commit-Position: refs/heads/master@{#488611}
nwjs · Jul 21, 2017 · 659015b · 659015b
1 parent 9469591
commit 659015b
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/third_party/WebKit/Source/bindings/core/v8/V8MutationCallback.h b/third_party/WebKit/Source/bindings/core/v8/V8MutationCallback.h
@@ -51,6 +51,12 @@ class V8MutationCallback final : public MutationCallback {
             MutationObserver*) override;
 
   ExecutionContext* GetExecutionContext() const override {
+    // The context might have navigated away or closed because this is an async
+    // call.  Check if the context is still alive.
+    // TODO(yukishiino): Make (V8?)MutationCallback inherit from ContextClient.
+    v8::HandleScope scope(script_state_->GetIsolate());
+    if (script_state_->GetContext().IsEmpty())
+      return nullptr;
     return ExecutionContext::From(script_state_.Get());
   }