Bug 1465162 - don't crash in ContentParent::RecvDeallocateLayerTreeId if the content parent ID doesn't exist; r?jld
MozReview-Commit-ID: IyLyhVUsOow
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -1619,17 +1619,17 @@ ContentParent::RecvAllocateLayerTreeId(c
mozilla::ipc::IPCResult
ContentParent::RecvDeallocateLayerTreeId(const ContentParentId& aCpId,
const layers::LayersId& aId)
{
GPUProcessManager* gpu = GPUProcessManager::Get();
ContentProcessManager* cpm = ContentProcessManager::GetSingleton();
RefPtr<ContentParent> contentParent = cpm->GetContentProcessById(aCpId);
- if (!contentParent->CanCommunicateWith(ChildID())) {
+ if (!contentParent || !contentParent->CanCommunicateWith(ChildID())) {
return IPC_FAIL(this, "Spoofed DeallocateLayerTreeId call");
}
if (!gpu->IsLayerTreeIdMapped(aId, contentParent->OtherPid())) {
// You can't deallocate layer tree ids that you didn't allocate
KillHard("DeallocateLayerTreeId");
}