Fix use-after-free of Profile after it's been destroyed.

chrome/browser/ui/views/accessibility/accessibility_event_router_views.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_UI_VIEWS_ACCESSIBILITY_ACCESSIBILITY_EVENT_ROUTER_VIEWS_H_
 #define CHROME_BROWSER_UI_VIEWS_ACCESSIBILITY_ACCESSIBILITY_EVENT_ROUTER_VIEWS_H_
 
 #include <string>
 
 #include "base/basictypes.h"
 #include "base/gtest_prod_util.h"
+#include "base/memory/scoped_ptr.h"
 #include "base/string16.h"
 #include "chrome/browser/accessibility/accessibility_events.h"
+#include "content/public/browser/notification_observer.h"
 #include "ui/base/accessibility/accessibility_types.h"
 
 class Profile;
 
 template <typename T> struct DefaultSingletonTraits;
 
+namespace content {
+class NotificationRegistrar;
+}
+
 namespace views {
 class View;
 }
 
 // NOTE: This class is part of the Accessibility Extension API, which lets
 // extensions receive accessibility events. It's distinct from code that
 // implements platform accessibility APIs like MSAA or ATK.
 //
 // Singleton class that adds listeners to many views, then sends an
 // accessibility notification whenever a relevant event occurs in an
 // accessible view.
 //
 // Views are not accessible by default. When you register a root widget,
 // that widget and all of its descendants will start sending accessibility
 // event notifications. You can then override the default behavior for
 // specific descendants using other methods.
 //
 // You can use Profile::PauseAccessibilityEvents to prevent a flurry
 // of accessibility events when a window is being created or initialized.
-class AccessibilityEventRouterViews {
+class AccessibilityEventRouterViews : public content::NotificationObserver {
  public:
   // Internal information about a particular view to override the
   // information we get directly from the view.
   struct ViewInfo {
     ViewInfo() : ignore(false) {}
 
     // If nonempty, will use this name instead of the view's label.
     std::string name;
 
     // If true, will ignore this widget and not send accessibility events.
     bool ignore;
   };
 
   // Get the single instance of this class.
   static AccessibilityEventRouterViews* GetInstance();
 
   // Handle an accessibility event generated by a view.
   void HandleAccessibilityEvent(
       views::View* view, ui::AccessibilityTypes::Event event_type);
 
   // Handle a menu item being focused (separate because a menu item is
   // not necessarily its own view).
   void HandleMenuItemFocused(const string16& menu_name,
                              const string16& menu_item_name,
                              int item_index,
                              int item_count,
                              bool has_submenu);
 
+  // NotificationObserver implementation.
+  virtual void Observe(int type,
+                       const content::NotificationSource& source,
+                       const content::NotificationDetails& details) OVERRIDE;
+
  private:
   friend struct DefaultSingletonTraits<AccessibilityEventRouterViews>;
 
   FRIEND_TEST_ALL_PREFIXES(AccessibilityEventRouterViewsTest,
                            TestFocusNotification);
 
   AccessibilityEventRouterViews();
   virtual ~AccessibilityEventRouterViews();
 
   // Checks the type of the view and calls one of the more specific
@@ skipping 67 matching lines @@
                                                 int* count);
 
   // Recursively explore the subviews and return the text from the first
   // subview with a role of STATIC_TEXT.
   static std::string RecursiveGetStaticText(views::View* view);
 
   // The profile associated with the most recent window event  - used to
   // figure out where to route a few events that can't be directly traced
   // to a window with a profile (like menu events).
   Profile* most_recent_profile_;
+
+  // Notification registrar so we can clear most_recent_profile_ when a
+  // profile is destroyed.
+  scoped_ptr<content::NotificationRegistrar> registrar_;

[Lei Zhang, 2013/04/03 21:56:49]

Any particular reason for making it a scoper? Most code I have read just
declares it as: <content::NotificationRegistrar registrar_;

[dmazzoni, 2013/04/03 22:02:29]

One less include in a header file?

I have no strong preference, I got rid of the scoped_ptr.

 };
 
 #endif  // CHROME_BROWSER_UI_VIEWS_ACCESSIBILITY_ACCESSIBILITY_EVENT_ROUTER_VIEWS_H_