commit 1ea51eb3e6a0d7c65d3694217dba3a89da80efaa
author Mickey Burks <mickeyburks@chromium.org> Wed Feb 12 00:14:37 2025
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Wed Feb 12 00:14:37 2025
tree 94121acc951acbb42a8bfbd1c786f0acae418b60
parent ebfe561a840901d5e651edd7d53467506e7b73aa

[TabGroupSync] Avoid crash when tab closes

If the tab was closed before the avatar could be fetched, the unretained
pointer would be UAF.

Fixed: 395899230
Change-Id: Ifc50a0a55d234293ab2152cf63d68109693a3f87
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6254880
Reviewed-by: Darryl James <dljames@chromium.org>
Commit-Queue: Mickey Burks <mickeyburks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1418985}

chrome/browser/ui/tabs/saved_tab_groups/collaboration_messaging_tab_data.cc

diff --git a/chrome/browser/ui/tabs/saved_tab_groups/collaboration_messaging_tab_data.cc b/chrome/browser/ui/tabs/saved_tab_groups/collaboration_messaging_tab_data.cc
index cc8c17f..f8e78b7 100644
--- a/chrome/browser/ui/tabs/saved_tab_groups/collaboration_messaging_tab_data.cc
+++ b/chrome/browser/ui/tabs/saved_tab_groups/collaboration_messaging_tab_data.cc
@@ -119,7 +119,7 @@
   data_sharing_service->GetAvatarImageForURL(
       avatar_url, signin::kAccountInfoImageSize,
       base::BindOnce(&CollaborationMessagingTabData::CommitMessage,
-                     base::Unretained(this), message),
+                     GetWeakPtr(), message),
       image_fetcher_service->GetImageFetcher(
           image_fetcher::ImageFetcherConfig::kDiskCacheOnly));
 }