commit a0f4fdfc54fd0e48d187a6be1f6dda653b38a4ad
author Kent Tamura <tkent@chromium.org> Wed Mar 20 00:50:30 2019
committer Kent Tamura <tkent@chromium.org> Wed Mar 20 00:50:30 2019
tree 6b146e0d3f56ae5f5492d6982e1a7fc11e5d1d05
parent 85ee316c031b0e8283431e93a739a346582ba669

Merge "Fix a crash on FileChooserImpl" to M73 branch

If a renderer process is compromised, and it calls both of
FileChooserImpl::OpenFileChooser() and EnumerateChosenDirectory() via
Mojo, the browser process could crash because ResetOwner() for
the first FileChooserImpl::proxy_ instance was not called.  We
should check nullness of proxy_ before updating it.

TBR=tkent@chromium.org

Bug: 941008
Change-Id: Ie0c1895ec46ce78d40594b543e49e43b420af675
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1520509
Reviewed-by: Avi Drissman <avi@chromium.org>
Commit-Queue: Kent Tamura <tkent@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#640580}(cherry picked from commit 4a3482693491ac6bb3dd27d591efa3de1d1f1fcf)
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1530225
Reviewed-by: Kent Tamura <tkent@chromium.org>
Cr-Commit-Position: refs/branch-heads/3683@{#857}
Cr-Branched-From: e51029943e0a38dd794b73caaf6373d5496ae783-refs/heads/master@{#625896}