commit | 13337a12d7e73fabcd9ea993b56b16df7b6bfae1 | [log] [tgz] |
---|---|---|
author | Joel Klinghed <the_jk@opera.com> | Fri May 03 20:36:23 2019 |
committer | Commit Bot <commit-bot@chromium.org> | Fri May 03 20:36:23 2019 |
tree | d4ba65bc89ed3be189f04899815d176e0e8f18b6 | |
parent | 5627cd881e969b32e7fe79b629dabcea5fa6c7f2 [diff] |
Avoid calling a removed observer in PersonalDataManager PersonalDataManager::NotifyPersonalDataObserver will call OnPersonalDataChanged and often OnPersonalDataFinishedProfileTasks on PersonalDataManagerObserver. Trouble is that it does this in the same ObserverList loop. So if PersonalDataManagerObserver implementation of OnPersonalDataChanged calls PersonalDataManager::RemoveObserver(this) then it will still be called on OnPersonalDataFinishedProfileTasks. Worse, if PersonalDataManagerObserver deleted itself after removing itself as an observer you now have a use-after-free calling a virtual method on a destroyed object. There are not currently any PersonalDataManagerObserver implementations that I can find that has this problem. Bug: 959172 Change-Id: I2bb0a625f5c3a847c5d035ccc57b5fdb349366b8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1594529 Commit-Queue: Joel Klinghed <the_jk@opera.com> Reviewed-by: Parastoo Geranmayeh <parastoog@google.com> Cr-Commit-Position: refs/heads/master@{#656489}
Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.
The project's web site is https://www.chromium.org.
Documentation in the source is rooted in docs/README.md.
Learn how to Get Around the Chromium Source Code Directory Structure .