Fix use-after-free of Profile after it's been destroyed.

chrome/browser/ui/views/accessibility/accessibility_event_router_views.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/views/accessibility/accessibility_event_router_views.h"
 
 #include "base/basictypes.h"
 #include "base/callback.h"
 #include "base/memory/singleton.h"
 #include "base/message_loop.h"
 #include "base/utf_string_conversions.h"
 #include "chrome/browser/accessibility/accessibility_extension_api.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/common/chrome_notification_types.h"
+#include "content/public/browser/notification_service.h"
+#include "content/public/browser/notification_source.h"
 #include "ui/base/accessibility/accessible_view_state.h"
 #include "ui/views/controls/button/text_button.h"
 #include "ui/views/controls/menu/menu_item_view.h"
 #include "ui/views/controls/menu/submenu_view.h"
 #include "ui/views/view.h"
 #include "ui/views/widget/widget.h"
 
 using views::FocusManager;
 
 AccessibilityEventRouterViews::AccessibilityEventRouterViews()
     : most_recent_profile_(NULL) {
+  registrar_.reset(new content::NotificationRegistrar);
+  // Register for notification when profile is destroyed to ensure that all
+  // observers are detatched at that time.
+  registrar_->Add(this, chrome::NOTIFICATION_PROFILE_DESTROYED,
+                  content::NotificationService::AllSources());
 }
 
 AccessibilityEventRouterViews::~AccessibilityEventRouterViews() {
 }
 
 // static
 AccessibilityEventRouterViews* AccessibilityEventRouterViews::GetInstance() {
   return Singleton<AccessibilityEventRouterViews>::get();
 }
 
@@ skipping 55 matching lines @@
   AccessibilityMenuItemInfo info(most_recent_profile_,
                                  UTF16ToUTF8(menu_item_name),
                                  UTF16ToUTF8(menu_name),
                                  has_submenu,
                                  item_index,
                                  item_count);
   SendAccessibilityNotification(
       chrome::NOTIFICATION_ACCESSIBILITY_CONTROL_FOCUSED, &info);
 }
 
+void AccessibilityEventRouterViews::Observe(
+    int type,
+    const content::NotificationSource& source,
+    const content::NotificationDetails& details) {
+  if (type == chrome::NOTIFICATION_PROFILE_DESTROYED) {

[Lei Zhang, 2013/04/03 21:56:49]

You can just DCHECK this.

[dmazzoni, 2013/04/03 22:02:29]

Done.

+    Profile* profile = content::Source<Profile>(source).ptr();
+    if (profile == most_recent_profile_)
+      most_recent_profile_ = NULL;
+  }
+}
+
 //
 // Private methods
 //
 
 void AccessibilityEventRouterViews::DispatchAccessibilityNotification(
     views::View* view, int type) {
   // Get the profile associated with this view. If it's not found, use
   // the most recent profile where accessibility events were sent, or
   // the default profile.
   Profile* profile = NULL;
   views::Widget* widget = view->GetWidget();
   if (widget) {
     profile = reinterpret_cast<Profile*>(
         widget->GetNativeWindowProperty(Profile::kProfileKey));
   }
   if (!profile)
     profile = most_recent_profile_;
-  if (!profile)
-    profile = g_browser_process->profile_manager()->GetLastUsedProfile();
   if (!profile) {
-    NOTREACHED();
+    if (g_browser_process->profile_manager())
+      profile = g_browser_process->profile_manager()->GetLastUsedProfile();
+  }
+  if (!profile) {
+    LOG(WARNING) << "Accessibility notification but no profile";
     return;
   }
 
   most_recent_profile_ = profile;
 
   if (type == chrome::NOTIFICATION_ACCESSIBILITY_MENU_OPENED ||
       type == chrome::NOTIFICATION_ACCESSIBILITY_MENU_CLOSED) {
     SendMenuNotification(view, type, profile);
     return;
   }
@@ skipping 306 matching lines @@
     return UTF16ToUTF8(state.name);
 
   for (int i = 0; i < view->child_count(); ++i) {
     views::View* child = view->child_at(i);
     std::string result = RecursiveGetStaticText(child);
     if (!result.empty())
       return result;
   }
   return std::string();
 }