Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(308)

Unified Diff: base/values.cc

Issue 2750533003: Temporarily CHECK use after free in Value (Closed)
Patch Set: Fix more Created 3 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « base/values.h ('k') | chrome/browser/ui/cocoa/applescript/apple_event_util.mm » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: base/values.cc
diff --git a/base/values.cc b/base/values.cc
index 5cc0d693bdd11c12e60f14f8921bec3cd303e4da..9aef2ec67005a7608405beaf2bafcdb496bc06f7 100644
--- a/base/values.cc
+++ b/base/values.cc
@@ -124,6 +124,10 @@ Value::Value(Type type) : type_(type) {
case Type::LIST:
list_.Init();
return;
+ case Type::DELETED:
+ // TODO(crbug.com/697817): Remove.
+ CHECK(false);
+ return;
}
}
@@ -200,6 +204,7 @@ Value& Value::operator=(Value&& that) {
Value::~Value() {
InternalCleanup();
+ type_ = Type::DELETED;
}
// static
@@ -442,6 +447,10 @@ bool Value::Equals(const Value* other) const {
return lhs->Equals(rhs.get());
});
}
+ case Type::DELETED:
+ // TODO(crbug.com/697817): This means a use-after-free.
+ CHECK(false);
+ return false;
}
NOTREACHED();
@@ -503,6 +512,10 @@ void Value::InternalCopyConstructFrom(const Value& that) {
case Type::LIST:
list_.Init(std::move(*that.CreateDeepCopy()->list_));
return;
+ case Type::DELETED:
+ // TODO(crbug.com/697817): This means |that| is used after free.
+ CHECK(false);
+ return;
}
}
@@ -529,6 +542,10 @@ void Value::InternalMoveConstructFrom(Value&& that) {
case Type::LIST:
list_.InitFromMove(std::move(that.list_));
return;
+ case Type::DELETED:
+ // TODO(crbug.com/697817): This means |that| is used after free.
+ CHECK(false);
+ return;
}
}
@@ -559,6 +576,10 @@ void Value::InternalCopyAssignFromSameType(const Value& that) {
case Type::LIST:
*list_ = std::move(*that.CreateDeepCopy()->list_);
return;
+ case Type::DELETED:
+ // TODO(crbug.com/697817): This means |that| is used after free.
+ CHECK(false);
+ return;
}
}
@@ -585,6 +606,10 @@ void Value::InternalMoveAssignFromSameType(Value&& that) {
case Type::LIST:
*list_ = std::move(*that.list_);
return;
+ case Type::DELETED:
+ // TODO(crbug.com/697817): This means |that| is used after free.
+ CHECK(false);
+ return;
}
}
@@ -609,6 +634,10 @@ void Value::InternalCleanup() {
case Type::LIST:
list_.Destroy();
return;
+ case Type::DELETED:
+ // TODO(crbug.com/697817): This means a use-after-free.
+ CHECK(false);
+ return;
}
}
« no previous file with comments | « base/values.h ('k') | chrome/browser/ui/cocoa/applescript/apple_event_util.mm » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698