commit 7730647169f306f754d04f365bfdd7a2dbdafc1f
author Keren Zhu <kerenzhu@chromium.org> Tue Jun 14 16:08:37 2022
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Tue Jun 14 16:08:37 2022
tree 527aa2c58dc7a44ecc62cdc786a68678bc7d11fa
parent b24393fa8cf39ab3baf6c3f8c2bdd8e9191a9b21

[M103] Remove dangling tab capture contents border widget when browser closes

When sharing a tab, an overlaying widget is created to display the blue
contents border as a child of browser widget. However, this widget is
not closed along with the browser widget. When native theme updates,
this dangling widget will access its parent and cause a use-after-free.

This CL fixes it by using the default NATIVE_WIDGET_OWNS_WIDGET for the
border widget. Since it is a child of the browser widget, the native
widget should be closed alongside its parent.

(cherry picked from commit 934e83a77673acac52d1963aa6fea080e1dfb447)

Bug: 1318555
Change-Id: I098889c23c9a74663860f3a1dfec6ab74b2d32e5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3698825
Auto-Submit: Keren Zhu <kerenzhu@chromium.org>
Reviewed-by: Elad Alon <eladalon@chromium.org>
Commit-Queue: Keren Zhu <kerenzhu@chromium.org>
Reviewed-by: Elly Fong-Jones <ellyjones@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1013116}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3702746
Commit-Queue: Elad Alon <eladalon@chromium.org>
Cr-Commit-Position: refs/branch-heads/5060@{#833}
Cr-Branched-From: b83393d0f4038aeaf67f970a024d8101df7348d1-refs/heads/main@{#1002911}