ProfileChooserVIew heap-use-after-free fix

chrome/browser/ui/views/profiles/profile_chooser_view.cc

Index: chrome/browser/ui/views/profiles/profile_chooser_view.cc
diff --git a/chrome/browser/ui/views/profiles/profile_chooser_view.cc b/chrome/browser/ui/views/profiles/profile_chooser_view.cc
index f61db462d9c4d91c3faf440c3da8055a1d874684..903d0f806e721f7443ace644001f29cb52a0d03d 100644
--- a/chrome/browser/ui/views/profiles/profile_chooser_view.cc
+++ b/chrome/browser/ui/views/profiles/profile_chooser_view.cc
@@ -24,9 +24,11 @@
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_commands.h"
 #include "chrome/browser/ui/browser_dialogs.h"
+#include "chrome/browser/ui/browser_list.h"
 #include "chrome/browser/ui/chrome_pages.h"
 #include "chrome/browser/ui/singleton_tabs.h"
 #include "chrome/browser/ui/user_manager.h"
+#include "chrome/browser/ui/views/frame/browser_view.h"
 #include "chrome/browser/ui/views/profiles/user_manager_view.h"
 #include "chrome/browser/ui/webui/signin/login_ui_service.h"
 #include "chrome/browser/ui/webui/signin/login_ui_service_factory.h"
@@ -563,6 +565,9 @@ void ProfileChooserView::ShowBubble(
 
   profile_bubble_ = new ProfileChooserView(anchor_view, arrow, browser,
       view_mode, tutorial_mode, manage_accounts_params.service_type);
+  BrowserView* browser_view = static_cast<BrowserView*>(browser->window());

[msw, 2015/09/10 23:42:00]

nit: use BrowserView::GetBrowserViewForBrowser

+  profile_bubble_->set_parent_window(
+      browser_view->GetActiveWebContents()->GetNativeView());

[msw, 2015/09/10 23:42:00]

Setting the parent of the profile bubble to the active web contents' window
doesn't make sense... Shouldn't it use the associated *browser* window? AFAICT,
that should already be done just by passing |anchor_view| (unless that's null
for fullscreen, etc.). When is the |browser| being destroyed in relation to this
crash?

The anchor should be reset when the Browser widget's destruction calls
OnWidgetDestroying, and (more pertinently) I think that parent window
destruction should trigger child window destruction, but I can't easily find
that code path. So, I think the defect here is that in step 4 on the bug the
deletion of Browser B doesn't trigger bubble destruction.

   views::BubbleDelegateView::CreateBubble(profile_bubble_);
   profile_bubble_->set_close_on_deactivate(close_on_deactivate_for_testing_);
   profile_bubble_->SetAlignment(border_alignment);