Google Git
Sign in
chromium / chromium / src / 40316d774f882abb7308931a7fb4a41790efb6ce
commit40316d774f882abb7308931a7fb4a41790efb6ce[log] [tgz]
authorphillis <phillis@chromium.org>Fri Jun 03 19:48:44 2022
committerChromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com>Fri Jun 03 19:48:44 2022
treedb20b71b33048c63f13fa465710d62055ff1420f
parent0a5cad4bc6c65cd030093720fb7599ac4cb00ef0 [diff]
DPWA: fix UAF on launch --uninstall-app-id

`WebAppUninstallDialogDelegateView` is a `DialogDelegate` and is owned by its widget. It was
triggering a callback on `OnDialogCanceled`.
The callback was passed from `WebAppUiManagerImpl` to release a
`ScopedKeepAlive`, which could trigger a browser shutdown and further
attempts to close the dialog widget, which races with the widget &
delegate's destruction managed by views framework.

The fix removes the redundant and too-early callback call on
`OnDialogCanceled` and only call it on destruction.

Bug: 1330289
Change-Id: I660c0af08a460ce6cedace8d0871dcb925ad9d76
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3688264
Commit-Queue: Phillis Tang <phillis@chromium.org>
Reviewed-by: Chase Phillips <cmp@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1010715}
2 files changed
tree: db20b71b33048c63f13fa465710d62055ff1420f
  1. android_webview/
  2. apps/
  3. ash/
  4. base/
  5. build/
  6. build_overrides/
  7. buildtools/
  8. cc/
  9. chrome/
  10. chromecast/
  11. chromeos/
  12. codelabs/
  13. components/
  14. content/
  15. courgette/
  16. crypto/
  17. dbus/
  18. device/
  19. docs/
  20. extensions/
  21. fuchsia/
  22. fuchsia_web/
  23. gin/
  24. google_apis/
  25. google_update/
  26. gpu/
  27. headless/
  28. infra/
  29. ios/
  30. ipc/
  31. media/
  32. mojo/
  33. native_client_sdk/
  34. net/
  35. pdf/
  36. ppapi/
  37. printing/
  38. remoting/
  39. rlz/
  40. sandbox/
  41. services/
  42. skia/
  43. sql/
  44. storage/
  45. styleguide/
  46. testing/
  47. third_party/
  48. tools/
  49. ui/
  50. url/
  51. weblayer/
  52. .clang-format
  53. .clang-tidy
  54. .eslintrc.js
  55. .git-blame-ignore-revs
  56. .gitattributes
  57. .gitignore
  58. .gn
  59. .mailmap
  60. .rustfmt.toml
  61. .vpython
  62. .vpython3
  63. .yapfignore
  64. AUTHORS
  65. BUILD.gn
  66. CODE_OF_CONDUCT.md
  67. codereview.settings
  68. DEPS
  69. DIR_METADATA
  70. ENG_REVIEW_OWNERS
  71. LICENSE
  72. LICENSE.chromium_os
  73. OWNERS
  74. PRESUBMIT.py
  75. PRESUBMIT_test.py
  76. PRESUBMIT_test_mocks.py
  77. README.md
  78. WATCHLISTS
README.md

Logo Chromium

Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.

The project's web site is https://www.chromium.org.

To check out the source code locally, don't use git clone! Instead, follow the instructions on how to get the code.

Documentation in the source is rooted in docs/README.md.

Learn how to Get Around the Chromium Source Code Directory Structure .

For historical reasons, there are some small top level directories. Now the guidance is that new top level directories are for product (e.g. Chrome, Android WebView, Ash). Even if these products have multiple executables, the code should be in subdirectories of the product.

If you found a bug, please file it at https://crbug.com/new.