am ec366141: am 7f034a17: Fix a ref counting bug in touch event handling. The RefPtr returned from m_originatingTouchPointTargets.take() was only in scope for the duration of the else block but we saved the raw pointer it wrapped. When the else block ended, the RefPtr

Merge commit 'ec3661418dd6a5edfca19848a0fa12a28959bd06' into kraken

* commit 'ec3661418dd6a5edfca19848a0fa12a28959bd06':
  Fix a ref counting bug in touch event handling. The RefPtr returned from m_originatingTouchPointTargets.take() was only in scope

1 files changed, 5 insertions, 5 deletions

diff --git a/WebCore/page/EventHandler.cpp b/WebCore/page/EventHandler.cpp
index 5904934..2e07b6a 100644
--- a/WebCore/page/EventHandler.cpp
+++ b/WebCore/page/EventHandler.cpp
@@ -2602,21 +2602,21 @@ bool EventHandler::handleTouchEvent(const PlatformTouchEvent& event)
 
         // Increment the platform touch id by 1 to avoid storing a key of 0 in the hashmap.
         unsigned touchPointTargetKey = point.id() + 1;
-        EventTarget* touchTarget = 0;
+        RefPtr<EventTarget> touchTarget;
         if (point.state() == PlatformTouchPoint::TouchPressed) {
             m_originatingTouchPointTargets.set(touchPointTargetKey, target);
             touchTarget = target;
         } else if (point.state() == PlatformTouchPoint::TouchReleased || point.state() == PlatformTouchPoint::TouchCancelled) {
             // The target should be the original target for this touch, so get it from the hashmap. As it's a release or cancel
             // we also remove it from the map.
-            touchTarget = m_originatingTouchPointTargets.take(touchPointTargetKey).get();
+            touchTarget = m_originatingTouchPointTargets.take(touchPointTargetKey);
         } else
-            touchTarget = m_originatingTouchPointTargets.get(touchPointTargetKey).get();
+            touchTarget = m_originatingTouchPointTargets.get(touchPointTargetKey);
 
-        if (!touchTarget)
+        if (!touchTarget.get())
             continue;
 
-        RefPtr<Touch> touch = Touch::create(doc->frame(), touchTarget, point.id(),
+        RefPtr<Touch> touch = Touch::create(doc->frame(), touchTarget.get(), point.id(),
                                             point.screenPos().x(), point.screenPos().y(),
                                             adjustedPageX, adjustedPageY);