[Mac] Inform reference counted objects that hold a weak Browser* when the Browser is being destroye…

chrome/browser/ui/cocoa/browser_window_controller.mm

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "chrome/browser/ui/cocoa/browser_window_controller.h"
 
 #include <cmath>
 #include <numeric>
 
 #include "base/command_line.h"
@@ skipping 284 matching lines @@
 
     // Create a sub-controller for the docked devTools and add its view to the
     // hierarchy.
     devToolsController_.reset([[DevToolsController alloc] init]);
     [[devToolsController_ view] setFrame:[[self tabContentArea] bounds]];
     [[self tabContentArea] addSubview:[devToolsController_ view]];
 
     // Create the overlayable contents controller.  This provides the switch
     // view that TabStripController needs.
     overlayableContentsController_.reset(
-        [[OverlayableContentsController alloc] initWithBrowser:browser]);
+        [[OverlayableContentsController alloc] init]);
     [[overlayableContentsController_ view]
         setFrame:[[devToolsController_ view] bounds]];
     [[devToolsController_ view]
         addSubview:[overlayableContentsController_ view]];
 
     // Create a controller for the tab strip, giving it the model object for
     // this window's Browser and the tab strip view. The controller will handle
     // registering for the appropriate tab notifications from the back-end and
     // managing the creation of new tabs.
     [self createTabStripController];
@@ skipping 102 matching lines @@
             windowShim_.get()));
 
     // We are done initializing now.
     initializing_ = NO;
   }
   return self;
 }
 
 - (void)dealloc {
   browser_->tab_strip_model()->CloseAllTabs();
   [downloadShelfController_ exiting];

[tapted, 2015/07/07 04:25:59]

I think this is redundant now that downloadShelfController_
browserWillBeDestroyed calls it.

[jackhou1, 2015/07/07 08:33:05]

Done.

 
   // Explicitly release |presentationModeController_| here, as it may call back
   // to this BWC in |-dealloc|.  We are required to call |-exitPresentationMode|
   // before releasing the controller.
   [presentationModeController_ exitPresentationMode];
   presentationModeController_.reset();
 
   // Under certain testing configurations we may not actually own the browser.
   if (ownsBrowser_ == NO)
     ignore_result(browser_.release());
 
   [[NSNotificationCenter defaultCenter] removeObserver:self];
 
+  // Inform reference counted objects that the Browser will be destroyed. This
+  // ensures they invalidate their weak Browser* to prevent use-after-free.
+  // These may outlive the Browser if they are retained by something else, e.g.
+  // an autorelease NSView or an NSEvent.

[tapted, 2015/07/07 04:25:59]

You could mention here, something like,

For example, since 10.10, the Nib loader internally creates an NSDictionary
referencing views/controllers which is autoreleased, so there is no way to
guarantee that the [super dealloc] call below will also call dealloc on the
controllers.

[jackhou1, 2015/07/07 08:33:05]

Done.

+  [toolbarController_ browserWillBeDestroyed];
+  [tabStripController_ browserWillBeDestroyed];
+  [findBarCocoaController_ browserWillBeDestroyed];
+  [downloadShelfController_ browserWillBeDestroyed];
+  [bookmarkBarController_ browserWillBeDestroyed];
+  [avatarButtonController_ browserWillBeDestroyed];
+
   [super dealloc];
 }
 
 - (gfx::Rect)enforceMinWindowSize:(gfx::Rect)bounds {
   gfx::Rect checkedBounds = bounds;
 
   NSSize minSize = [[self window] minSize];
   if (bounds.width() < minSize.width)
       checkedBounds.set_width(minSize.width);
   if (bounds.height() < minSize.height)
@@ skipping 1793 matching lines @@
 
 - (BOOL)supportsBookmarkBar {
   return [self supportsWindowFeature:Browser::FEATURE_BOOKMARKBAR];
 }
 
 - (BOOL)isTabbedWindow {
   return browser_->is_type_tabbed();
 }
 
 @end  // @implementation BrowserWindowController(WindowType)