Issue 7127001: Fix user-after-free error with ObserverList. The problem is that if an ObserverListBase::Iterato...

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Issue 7127001: Fix user-after-free error with ObserverList. The problem is that if an ObserverListBase::Iterato... (Closed)

Created:
9 years, 6 months ago by jam

Modified:
9 years, 6 months ago

Reviewers:
Evan Martin

CC:
chromium-reviews, joi+watch-content_chromium.org, Paweł Hajdan Jr., brettw-cc_chromium.org

Base URL:
svn://chrome-svn/chrome/trunk/src/

Visibility:
Public.

Description

Fix user-after-free error with ObserverList. The problem is that if an ObserverListBase::Iterator is on the stack and one of the observers deletes the object holding the list, Iterator's destructor will use the deleted list. BUG=84919 Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=88151

Patch Set 1 #

Total comments: 1

Created: 9 years, 6 months ago

Download [raw] [tar.bz2]

	Unified diffs	Side-by-side diffs	Stats (+39 lines, -17 lines)			Patch
M	base/observer_list.h	View	4 chunks	+11 lines, -7 lines	0 comments	Download
M	base/observer_list_unittest.cc	View	1 chunk	+23 lines, -0 lines	0 comments	Download
M	content/browser/renderer_host/render_view_host.cc	View	1 chunk	+5 lines, -10 lines	1 comment	Download

Messages

Total messages: 2 (0 generated)

Expand Messages | Collapse Messages

Evan Martin

9 years, 6 months ago (2011-06-07 18:01:50 UTC) #2

LGTM

http://codereview.chromium.org/7127001/diff/1/content/browser/renderer_host/r...
File content/browser/renderer_host/render_view_host.cc (right):

http://codereview.chromium.org/7127001/diff/1/content/browser/renderer_host/r...
content/browser/renderer_host/render_view_host.cc:611: while ((observer =
it.GetNext()) != NULL)
curlies on this while loop

Expand Messages | Collapse Messages