commit 600b729641e51545d65bb8d5d939cef3a96b42ee
author Daniel Andersson <dandersson@chromium.org> Tue Jun 21 19:50:17 2022
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Tue Jun 21 19:50:17 2022
tree 368c0deee56f34dd83f87bcd9555eba467dda044
parent 9fe85e3327d085de9cd4f13f6ad83234a1b95401

saved_desks: Bail early on showing a dialog if one is already active.

This takes care of a UAF with a complicated call chain. Repro steps can
be found in the bug. What happens is that when the close button on one
saved desk item is clicked, this will:

* Trigger ShowDeleteDialog.
* Un-blur the name entry on the other desk item.
** Which will in turn trigger ShowReplaceDialog.

This cases the dialog controller to try to close the first dialog, which
will for some window activation reason cause overview mode to exit. This
will in turn destroy the SavedDeskDialogController that is currently
executing code, which eventually leads to the UAF.

This change sidesteps this mess by bailing early on showing a dialog if
one is already active. What happens when the repro steps are followed is
that the delete dialog will be shown, and the newly created desk item
with the duplicate name will have "(1)" tacked on at the end.

(cherry picked from commit 2d4699f12772406edfbb74c3931de904adf48bb5)

Bug: 1327087
Change-Id: I8aa65815c02940e8de24d0651faaedff072dedfc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3674408
Commit-Queue: Daniel Andersson <dandersson@chromium.org>
Reviewed-by: Sammie Quon <sammiequon@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1009145}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3717283
Cr-Commit-Position: refs/branch-heads/5060@{#1016}
Cr-Branched-From: b83393d0f4038aeaf67f970a024d8101df7348d1-refs/heads/main@{#1002911}