tree 34e1baac33e51bf27b355be72bda01094e866e35
parent f36da203cf042f237f62fcf47b241aaf6ed8471b
author dljames <dljames@chromium.org> 1726775504 +0000
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> 1726775504 +0000

[CompactMode] Fix crash for incognito profiles

The incognito browser is destroyed before we have a chance to properly
unsubscribe from the PrefChangeRegistrar. This results in a UAF.

We mitigate this crash by first checking in BrowserViewLayout if the
profile is associated with incognito before subscribing.

The same issue is not present for other OTR profiles such as guest mode
while testing locally.

Change-Id: I73c801e409197d9d9d6f378a515df0ab2b6e2ae6
Bug: 365015374, 368369457
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5875142
Commit-Queue: Darryl James <dljames@chromium.org>
Reviewed-by: David Pennington <dpenning@chromium.org>
Reviewed-by: Caroline Rising <corising@chromium.org>
Code-Coverage: findit-for-me@appspot.gserviceaccount.com <findit-for-me@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#1357803}