Bug 1464194 - don't crash in ContentParent::RecvAllocateLayerTreeId if the content parent ID doesn't exist; r?jimm
MozReview-Commit-ID: FQxcTj3phIV
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -1594,17 +1594,18 @@ mozilla::ipc::IPCResult
ContentParent::RecvAllocateLayerTreeId(const ContentParentId& aCpId,
const TabId& aTabId, layers::LayersId* aId)
{
// Protect against spoofing by a compromised child. aCpId must either
// correspond to the process that this ContentParent represents or be a
// child of it.
ContentProcessManager* cpm = ContentProcessManager::GetSingleton();
RefPtr<ContentParent> contentParent = cpm->GetContentProcessById(aCpId);
- if (ChildID() != aCpId && !contentParent->CanCommunicateWith(ChildID())) {
+ if (!contentParent ||
+ (ChildID() != aCpId && !contentParent->CanCommunicateWith(ChildID()))) {
return IPC_FAIL_NO_REASON(this);
}
// GetTopLevelTabParentByProcessAndTabId will make sure that aTabId
// lives in the process for aCpId.
RefPtr<TabParent> browserParent =
cpm->GetTopLevelTabParentByProcessAndTabId(aCpId, aTabId);
MOZ_ASSERT(contentParent && browserParent);