Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1878)

Issue 2750633004: Adds code to isolate use-after-free in Views (Closed)

Created:
3 years, 9 months ago by sky
Modified:
3 years, 9 months ago
Reviewers:
msw, vapier
CC:
chromium-reviews, tfarina
Target Ref:
refs/pending/heads/master
Project:
chromium
Visibility:
Public.

Description

Adds code to isolate use-after-free in Views We are still seeing a fair number of crahes in View::Blur() that is called from FocusManager. These crashes indicate the View held by FocusManager has been deleted. Widget forwards a number of calls to the FocusManager when views are removed, so in theory we should never end with the FocusManager holding a deleted view. None-the-less crashes indicate otherwise. This patch stores the stack when focused_view_ is set, and if we end the view is deleted we extract the stack DumpWithoutCrashing() BUG=687232 TEST=none R=msw@chromium.org, vapier@chromium.org Review-Url: https://codereview.chromium.org/2750633004 Cr-Commit-Position: refs/heads/master@{#456856} Committed: https://chromium.googlesource.com/chromium/src/+/5edcc960338a8b074127eecfb3d09ba6ab7e7418

Patch Set 1 #

Total comments: 7

Patch Set 2 : feedback #

Total comments: 6

Patch Set 3 : feedback2 #

Patch Set 4 : rename to observed_view #

Total comments: 3
Unified diffs Side-by-side diffs Delta from patch set Stats (+83 lines, -4 lines) Patch
M ui/views/focus/focus_manager.h View 1 6 chunks +16 lines, -2 lines 0 comments Download
M ui/views/focus/focus_manager.cc View 1 2 5 chunks +61 lines, -2 lines 0 comments Download
M ui/views/view.cc View 1 chunk +3 lines, -0 lines 0 comments Download
M ui/views/view_observer.h View 1 2 3 1 chunk +3 lines, -0 lines 3 comments Download

Messages

Total messages: 27 (14 generated)
sky
vapier: FocusManager::OnViewIsDeleting msw: the rest
3 years, 9 months ago (2017-03-13 18:02:22 UTC) #1
msw
lgtm with nits and qs https://codereview.chromium.org/2750633004/diff/1/ui/views/focus/focus_manager.cc File ui/views/focus/focus_manager.cc (right): https://codereview.chromium.org/2750633004/diff/1/ui/views/focus/focus_manager.cc#newcode34 ui/views/focus/focus_manager.cc:34: bool did_log_focused_view = false; ...
3 years, 9 months ago (2017-03-13 18:22:16 UTC) #4
sky
https://codereview.chromium.org/2750633004/diff/1/ui/views/focus/focus_manager.cc File ui/views/focus/focus_manager.cc (right): https://codereview.chromium.org/2750633004/diff/1/ui/views/focus/focus_manager.cc#newcode34 ui/views/focus/focus_manager.cc:34: bool did_log_focused_view = false; On 2017/03/13 18:22:16, msw wrote: ...
3 years, 9 months ago (2017-03-13 19:04:02 UTC) #6
vapier
i'm not super familiar with Chromium internals https://codereview.chromium.org/2750633004/diff/20001/ui/views/focus/focus_manager.cc File ui/views/focus/focus_manager.cc (right): https://codereview.chromium.org/2750633004/diff/20001/ui/views/focus/focus_manager.cc#newcode608 ui/views/focus/focus_manager.cc:608: instruction_pointers_copy[0] = ...
3 years, 9 months ago (2017-03-13 22:06:09 UTC) #10
sky
https://codereview.chromium.org/2750633004/diff/20001/ui/views/focus/focus_manager.cc File ui/views/focus/focus_manager.cc (right): https://codereview.chromium.org/2750633004/diff/20001/ui/views/focus/focus_manager.cc#newcode608 ui/views/focus/focus_manager.cc:608: instruction_pointers_copy[0] = reinterpret_cast<const void*>(0x12345678); On 2017/03/13 22:06:09, vapier wrote: ...
3 years, 9 months ago (2017-03-14 03:46:07 UTC) #11
vapier
lgtm
3 years, 9 months ago (2017-03-14 20:27:25 UTC) #16
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.org/2750633004/60001
3 years, 9 months ago (2017-03-14 20:37:22 UTC) #19
msw
still lgtm with a nit https://codereview.chromium.org/2750633004/diff/60001/ui/views/view_observer.h File ui/views/view_observer.h (right): https://codereview.chromium.org/2750633004/diff/60001/ui/views/view_observer.h#newcode37 ui/views/view_observer.h:37: virtual void OnViewIsDeleting(View* observed_view) ...
3 years, 9 months ago (2017-03-14 20:37:55 UTC) #20
sky
https://codereview.chromium.org/2750633004/diff/60001/ui/views/view_observer.h File ui/views/view_observer.h (right): https://codereview.chromium.org/2750633004/diff/60001/ui/views/view_observer.h#newcode37 ui/views/view_observer.h:37: virtual void OnViewIsDeleting(View* observed_view) {} On 2017/03/14 20:37:55, msw ...
3 years, 9 months ago (2017-03-14 21:00:59 UTC) #21
msw
still lgtm https://codereview.chromium.org/2750633004/diff/60001/ui/views/view_observer.h File ui/views/view_observer.h (right): https://codereview.chromium.org/2750633004/diff/60001/ui/views/view_observer.h#newcode37 ui/views/view_observer.h:37: virtual void OnViewIsDeleting(View* observed_view) {} On 2017/03/14 ...
3 years, 9 months ago (2017-03-14 21:15:21 UTC) #22
sky
On 2017/03/14 21:15:21, msw wrote: > still lgtm > > https://codereview.chromium.org/2750633004/diff/60001/ui/views/view_observer.h > File ui/views/view_observer.h (right): ...
3 years, 9 months ago (2017-03-14 21:20:43 UTC) #23
msw
On 2017/03/14 21:20:43, sky wrote: > I did the rename to match another patch I'm ...
3 years, 9 months ago (2017-03-14 21:26:01 UTC) #24
commit-bot: I haz the power
3 years, 9 months ago (2017-03-14 22:08:17 UTC) #27
Message was sent while issue was closed.
Committed patchset #4 (id:60001) as
https://chromium.googlesource.com/chromium/src/+/5edcc960338a8b074127eecfb3d0...

Powered by Google App Engine
This is Rietveld 408576698