Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(330)

Side by Side Diff: chrome/browser/ui/cocoa/applescript/apple_event_util.mm

Issue 2750533003: Temporarily CHECK use after free in Value (Closed)
Patch Set: Fix more Created 3 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « base/values.cc ('k') | components/policy/core/browser/android/policy_converter.cc » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #import "chrome/browser/ui/cocoa/applescript/apple_event_util.h" 5 #import "chrome/browser/ui/cocoa/applescript/apple_event_util.h"
6 6
7 #import <Carbon/Carbon.h> 7 #import <Carbon/Carbon.h>
8 #include <stddef.h> 8 #include <stddef.h>
9 9
10 #include "base/logging.h" 10 #include "base/logging.h"
(...skipping 74 matching lines...) Expand 10 before | Expand all | Expand 10 after
85 value->GetAsList(&list_value); 85 value->GetAsList(&list_value);
86 descriptor = [NSAppleEventDescriptor listDescriptor]; 86 descriptor = [NSAppleEventDescriptor listDescriptor];
87 for (size_t i = 0; i < list_value->GetSize(); ++i) { 87 for (size_t i = 0; i < list_value->GetSize(); ++i) {
88 const base::Value* item; 88 const base::Value* item;
89 list_value->Get(i, &item); 89 list_value->Get(i, &item);
90 [descriptor insertDescriptor:ValueToAppleEventDescriptor(item) 90 [descriptor insertDescriptor:ValueToAppleEventDescriptor(item)
91 atIndex:0]; 91 atIndex:0];
92 } 92 }
93 break; 93 break;
94 } 94 }
95
96 case base::Value::Type::DELETED:
97 // TODO(crbug.com/697817): This means |value| is used after free.
98 CHECK(false);
99 break;
95 } 100 }
96 101
97 return descriptor; 102 return descriptor;
98 } 103 }
99 104
100 } // namespace mac 105 } // namespace mac
101 } // namespace chrome 106 } // namespace chrome
OLDNEW
« no previous file with comments | « base/values.cc ('k') | components/policy/core/browser/android/policy_converter.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698