Fix user-after-free error with ObserverList. The problem is that if an ObserverListBase::Iterato...

content/browser/renderer_host/render_view_host.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_view_host.h"
 
 #include <string>
 #include <utility>
 #include <vector>
 
@@ skipping 588 matching lines @@
 bool RenderViewHost::OnMessageReceived(const IPC::Message& msg) {
   if (!BrowserMessageFilter::CheckCanDispatchOnUI(msg, this))
     return true;
 
   // Filter out most IPC messages if this renderer is swapped out.
   // We still want to certain ACKs to keep our state consistent.
   if (is_swapped_out_)
     if (!content::SwappedOutMessages::CanHandleWhileSwappedOut(msg))
       return true;
 
-  {
-    // delegate_->OnMessageReceived can end up deleting |this|, in which case
-    // the destructor for ObserverListBase::Iterator would access the deleted
-    // observers_.
-    ObserverListBase<RenderViewHostObserver>::Iterator it(observers_);
-    RenderViewHostObserver* observer;
-    while ((observer = it.GetNext()) != NULL)
-      if (observer->OnMessageReceived(msg))
-        return true;
-  }
+  ObserverListBase<RenderViewHostObserver>::Iterator it(observers_);
+  RenderViewHostObserver* observer;
+  while ((observer = it.GetNext()) != NULL)

[Evan Martin, 2011/06/07 18:01:51]

curlies on this while loop

+    if (observer->OnMessageReceived(msg))
+      return true;
 
   if (delegate_->OnMessageReceived(msg))
     return true;
 
   bool handled = true;
   bool msg_is_ok = true;
   IPC_BEGIN_MESSAGE_MAP_EX(RenderViewHost, msg, msg_is_ok)
     IPC_MESSAGE_HANDLER(ViewHostMsg_ShowView, OnMsgShowView)
     IPC_MESSAGE_HANDLER(ViewHostMsg_ShowWidget, OnMsgShowWidget)
     IPC_MESSAGE_HANDLER(ViewHostMsg_ShowFullscreenWidget,
@@ skipping 641 matching lines @@
   if (view) {
     view->ShowPopupMenu(params.bounds,
                         params.item_height,
                         params.item_font_size,
                         params.selected_item,
                         params.popup_items,
                         params.right_aligned);
   }
 }
 #endif