Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(826)

Issue 2945163002: Avoid use-after-free when InterstitialPageImpl is being torn down. (Closed)

Created:
3 years, 6 months ago by Charlie Reis
Modified:
3 years, 6 months ago
Reviewers:
ncarter (slow)
CC:
chromium-reviews
Target Ref:
refs/branch-heads/3112
Project:
chromium
Visibility:
Public.

Description

Avoid use-after-free when InterstitialPageImpl is being torn down. The InterstitialPageNavigatorImpl was continuing to access parts of a deleted WebContents (e.g., the NavigationController) after its corresponding InterstitialPageImpl was disabled. This CL avoids the problem by checking for the disabled state. BUG=730592 TEST=NavigationHandleImpl crashes go away. CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_site_isolation Review-Url: https://codereview.chromium.org/2934353002 Cr-Original-Commit-Position: refs/heads/master@{#479544} Review-Url: https://codereview.chromium.org/2945163002 . Cr-Commit-Position: refs/branch-heads/3112@{#409} Cr-Branched-From: b6460e24cf59f429d69de255538d0fc7a425ccf9-refs/heads/master@{#474897} Committed: https://chromium.googlesource.com/chromium/src/+/bada48e0f4c8bb29ab5b0125411b860c2a0c3079

Patch Set 1 #

Unified diffs Side-by-side diffs Delta from patch set Stats (+74 lines, -1 line) Patch
M content/browser/frame_host/interstitial_page_impl.cc View 1 chunk +4 lines, -0 lines 0 comments Download
M content/browser/frame_host/interstitial_page_navigator_impl.h View 3 chunks +9 lines, -0 lines 0 comments Download
M content/browser/frame_host/interstitial_page_navigator_impl.cc View 4 chunks +17 lines, -1 line 0 comments Download
M content/browser/web_contents/web_contents_impl_unittest.cc View 2 chunks +44 lines, -0 lines 0 comments Download

Messages

Total messages: 4 (2 generated)
Charlie Reis
FYI: Merging to M60.
3 years, 6 months ago (2017-06-20 21:16:22 UTC) #2
Charlie Reis
3 years, 6 months ago (2017-06-20 21:17:01 UTC) #4
Message was sent while issue was closed.
Committed patchset #1 (id:1) manually as
bada48e0f4c8bb29ab5b0125411b860c2a0c3079 (tree was closed).

Powered by Google App Engine
This is Rietveld 408576698