OSXWindow fix a use after free of the WindowDelegate

This use after free was triggered when a window was made key and destroyed, then another window was made key. dedResignKey was called on the former's WindowDelegate which had already been freed, causing a crash. BUG=angleproject:891 Change-Id: If47e88419f9a407a6a77c5cd9853b7b4860dc698 Reviewed-on: https://chromium-review.googlesource.com/305817 Tryjob-Request: Corentin Wallez <cwallez@chromium.org> Reviewed-by: Jamie Madill <jmadill@chromium.org> Reviewed-by: Geoff Lang <geofflang@chromium.org> Commit-Queue: Corentin Wallez <cwallez@chromium.org> Tested-by: Corentin Wallez <cwallez@chromium.org>

OSXWindow fix a use after free of the WindowDelegate
b0228e18 · Corentin Wallez · 7c89d248 · b0228e18
Commit b0228e18 authored Oct 14, 2015 by Corentin Wallez
Hide whitespace changes
Inline Side-by-side

Showing with 14 additions and 3 deletions

OSXWindow.mm util/osx/OSXWindow.mm +14 -3

No files found.
--- a/util/osx/OSXWindow.mm
+++ b/util/osx/OSXWindow.mm
@@ -105,6 +105,11 @@ static float YCoordToFromCG(float y)
        return self;
    }
+    - (void) onOSXWindowDeleted
+    {
+        mWindow = nil;
+    }
    - (BOOL) windowShouldClose: (id) sender
    {
        Event event;
@@ -138,13 +143,18 @@ static float YCoordToFromCG(float y)
        Event event;
        event.Type = Event::EVENT_GAINED_FOCUS;
        mWindow->pushEvent(event);
+        [self retain];
    }
    - (void) windowDidResignKey: (NSNotification*) notification
    {
-        Event event;
+        if (mWindow != nil)
-        event.Type = Event::EVENT_LOST_FOCUS;
+        {
-        mWindow->pushEvent(event);
+            Event event;
+            event.Type = Event::EVENT_LOST_FOCUS;
+            mWindow->pushEvent(event);
+        }
+        [self release];
    }
 @end
@@ -570,6 +580,7 @@ void OSXWindow::destroy()
    [mView release];
    mView = nil;
+    [mDelegate onOSXWindowDeleted];
    [mDelegate release];
    mDelegate = nil;
    [mWindow release];