Descriptiondisplay compositor: Fix a use-after-free when a frame sink is destroyed.
Make a copy of the sink-id before removing it from the map. This is
because the id variable is owned by the GpuCompositorFrameSink in the
map. So when the sink is removed from the map, the id is also destroyed.
But the map can continue to iterate and try to use it. Making a copy of
it avoids this.
BUG=none
Review-Url: https://codereview.chromium.org/2673823002
Cr-Commit-Position: refs/heads/master@{#447898}
Committed: https://chromium.googlesource.com/chromium/src/+/60bd8863c89b4058872e1323173fbc3802efbcfc
Patch Set 1 #
Total comments: 4
Patch Set 2 : . #
Messages
Total messages: 14 (8 generated)
|