DescriptionRemove an assert that triggers a bad cast in blink::LifecycleNotifier.
The bad cast happens in
blink::LifecycleNotifier<blink::ExecutionContext, blink::ContextLifecycleObserver>::context(),
when it's called from the destructor. See https://crbug.com/537398.
The primary issue is that this method makes a base-to-derived cast at the time,
when the derived instance is already destroyed.
This bug was found by Control Flow Integrity check:
https://sites.google.com/a/chromium.org/dev/developers/testing/control-flow-integrity
BUG=chromium:537398, chromium:464797
Committed: https://crrev.com/58ce4660835621899e0129250e690059d9ece8a9
Cr-Commit-Position: refs/heads/master@{#351884}
Patch Set 1 #Patch Set 2 : no changes, just make sure the patch is accessible by bots #
Messages
Total messages: 13 (5 generated)
|