ProfileChooserVIew heap-use-after-free fix

chrome/browser/ui/views/profiles/profile_chooser_view.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/views/profiles/profile_chooser_view.h"
 
 #include "base/prefs/pref_service.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/lifetime/application_lifetime.h"
 #include "chrome/browser/prefs/incognito_mode_prefs.h"
 #include "chrome/browser/profiles/profile_avatar_icon_util.h"
 #include "chrome/browser/profiles/profile_info_cache.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/profiles/profile_metrics.h"
 #include "chrome/browser/profiles/profile_window.h"
 #include "chrome/browser/profiles/profiles_state.h"
 #include "chrome/browser/signin/chrome_signin_helper.h"
 #include "chrome/browser/signin/profile_oauth2_token_service_factory.h"
 #include "chrome/browser/signin/signin_error_controller_factory.h"
 #include "chrome/browser/signin/signin_manager_factory.h"
 #include "chrome/browser/signin/signin_promo.h"
 #include "chrome/browser/signin/signin_ui_util.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_commands.h"
 #include "chrome/browser/ui/browser_dialogs.h"
+#include "chrome/browser/ui/browser_list.h"
 #include "chrome/browser/ui/chrome_pages.h"
 #include "chrome/browser/ui/singleton_tabs.h"
 #include "chrome/browser/ui/user_manager.h"
+#include "chrome/browser/ui/views/frame/browser_view.h"
 #include "chrome/browser/ui/views/profiles/user_manager_view.h"
 #include "chrome/browser/ui/webui/signin/login_ui_service.h"
 #include "chrome/browser/ui/webui/signin/login_ui_service_factory.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/grit/chromium_strings.h"
 #include "chrome/grit/generated_resources.h"
 #include "components/signin/core/browser/profile_oauth2_token_service.h"
 #include "components/signin/core/browser/signin_error_controller.h"
 #include "components/signin/core/browser/signin_header_helper.h"
@@ skipping 516 matching lines @@
   if (IsShowing()) {
     if (tutorial_mode != profiles::TUTORIAL_MODE_NONE) {
       profile_bubble_->tutorial_mode_ = tutorial_mode;
       profile_bubble_->ShowView(view_mode, profile_bubble_->avatar_menu_.get());
     }
     return;
   }
 
   profile_bubble_ = new ProfileChooserView(anchor_view, arrow, browser,
       view_mode, tutorial_mode, manage_accounts_params.service_type);
+  BrowserView* browser_view = static_cast<BrowserView*>(browser->window());

[msw, 2015/09/10 23:42:00]

nit: use BrowserView::GetBrowserViewForBrowser

+  profile_bubble_->set_parent_window(
+      browser_view->GetActiveWebContents()->GetNativeView());

[msw, 2015/09/10 23:42:00]

Setting the parent of the profile bubble to the active web contents' window
doesn't make sense... Shouldn't it use the associated *browser* window? AFAICT,
that should already be done just by passing |anchor_view| (unless that's null
for fullscreen, etc.). When is the |browser| being destroyed in relation to this
crash?

The anchor should be reset when the Browser widget's destruction calls
OnWidgetDestroying, and (more pertinently) I think that parent window
destruction should trigger child window destruction, but I can't easily find
that code path. So, I think the defect here is that in step 4 on the bug the
deletion of Browser B doesn't trigger bubble destruction.

   views::BubbleDelegateView::CreateBubble(profile_bubble_);
   profile_bubble_->set_close_on_deactivate(close_on_deactivate_for_testing_);
   profile_bubble_->SetAlignment(border_alignment);
   profile_bubble_->GetWidget()->Show();
   profile_bubble_->SetArrowPaintType(views::BubbleBorder::PAINT_NONE);
 }
 
 // static
 bool ProfileChooserView::IsShowing() {
   return profile_bubble_ != NULL;
@@ skipping 1227 matching lines @@
       IncognitoModePrefs::GetAvailability(browser_->profile()->GetPrefs()) !=
           IncognitoModePrefs::DISABLED;
   return incognito_available && !browser_->profile()->IsGuestSession();
 }
 
 void ProfileChooserView::PostActionPerformed(
     ProfileMetrics::ProfileDesktopMenu action_performed) {
   ProfileMetrics::LogProfileDesktopMenu(action_performed, gaia_service_type_);
   gaia_service_type_ = signin::GAIA_SERVICE_TYPE_NONE;
 }