[Mac] Inform reference counted objects that hold a weak Browser* when the Browser is being destroye…

chrome/browser/ui/cocoa/browser_window_controller.mm

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "chrome/browser/ui/cocoa/browser_window_controller.h"
 
 #include <cmath>
 #include <numeric>
 
 #include "base/command_line.h"
@@ skipping 284 matching lines @@
 
     // Create a sub-controller for the docked devTools and add its view to the
     // hierarchy.
     devToolsController_.reset([[DevToolsController alloc] init]);
     [[devToolsController_ view] setFrame:[[self tabContentArea] bounds]];
     [[self tabContentArea] addSubview:[devToolsController_ view]];
 
     // Create the overlayable contents controller.  This provides the switch
     // view that TabStripController needs.
     overlayableContentsController_.reset(
-        [[OverlayableContentsController alloc] initWithBrowser:browser]);
+        [[OverlayableContentsController alloc] init]);
     [[overlayableContentsController_ view]
         setFrame:[[devToolsController_ view] bounds]];
     [[devToolsController_ view]
         addSubview:[overlayableContentsController_ view]];
 
     // Create a controller for the tab strip, giving it the model object for
     // this window's Browser and the tab strip view. The controller will handle
     // registering for the appropriate tab notifications from the back-end and
     // managing the creation of new tabs.
     [self createTabStripController];
@@ skipping 116 matching lines @@
   // before releasing the controller.
   [presentationModeController_ exitPresentationMode];
   presentationModeController_.reset();
 
   // Under certain testing configurations we may not actually own the browser.
   if (ownsBrowser_ == NO)
     ignore_result(browser_.release());
 
   [[NSNotificationCenter defaultCenter] removeObserver:self];
 
+  // Inform reference counted objects that the Browser will be destroyed. This
+  // insures they invalidate their weak Browser* to prevent use-after-free.

[tapted, 2015/07/06 07:26:17]

insures -> ensures?

[jackhou1, 2015/07/07 03:27:26]

Done.

+  // These may outlive the Browser if they are retained by something else, e.g.
+  // an autorelease NSView or an NSEvent.
+  [toolbarController_ browserWillBeDestroyed];
+  [tabStripController_ browserWillBeDestroyed];
+  [findBarCocoaController_ browserWillBeDestroyed];
+  [downloadShelfController_ browserWillBeDestroyed];
+  [bookmarkBarController_ browserWillBeDestroyed];
+  [avatarButtonController_ browserWillBeDestroyed];
+
   [super dealloc];
 }
 
 - (gfx::Rect)enforceMinWindowSize:(gfx::Rect)bounds {
   gfx::Rect checkedBounds = bounds;
 
   NSSize minSize = [[self window] minSize];
   if (bounds.width() < minSize.width)
       checkedBounds.set_width(minSize.width);
   if (bounds.height() < minSize.height)
@@ skipping 1793 matching lines @@
 
 - (BOOL)supportsBookmarkBar {
   return [self supportsWindowFeature:Browser::FEATURE_BOOKMARKBAR];
 }
 
 - (BOOL)isTabbedWindow {
   return browser_->is_type_tabbed();
 }
 
 @end  // @implementation BrowserWindowController(WindowType)