1ec867c8a1
* chore: [30-x-y] cherry-pick 11 changes from 3-M126 * d54105311590 from chromium * 43b8b682d05c from chromium * c5dd8839bfaf from chromium * cdbc1d9684a3 from v8 * 38e4483e47f9 from chromium * 70d2fe6b7c47 from v8 * 901377bb2f3b from v8 * 1b9040817119 from chromium * bb28367eed73 from v8 * 99cafbf4b4b9 from chromium * bc545b15a0ee from v8 * chore: update patches * 5639725: [wasm] Fix scanning of wasm-to-js params | https://chromium-review.googlesource.com/c/v8/v8/+/5639725 * 5672472: [M120-LTS] Prevent script injection on reload when racing with a navigation | https://chromium-review.googlesource.com/c/chromium/src/+/5672472
32 lines
1.8 KiB
Diff
32 lines
1.8 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Rakina Zata Amni <rakina@chromium.org>
|
|
Date: Wed, 19 Jun 2024 02:49:58 +0000
|
|
Subject: Destruct controller before referenced WebUI in CreateWebUIIfNeeded
|
|
|
|
Reset `controller` first before resetting `web_ui_`, since the
|
|
controller still has a pointer to `web_ui_`, to avoid referencing to
|
|
the already deleted `web_ui_` object from `controller`'s destructor.
|
|
|
|
Bug: 345640549
|
|
Change-Id: Ie9c193436b593845d8269605f68bf94bc75beed7
|
|
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5624749
|
|
Commit-Queue: Rakina Zata Amni <rakina@chromium.org>
|
|
Reviewed-by: Nasko Oskov <nasko@chromium.org>
|
|
Cr-Commit-Position: refs/heads/main@{#1316830}
|
|
|
|
diff --git a/content/browser/renderer_host/navigation_request.cc b/content/browser/renderer_host/navigation_request.cc
|
|
index 8a9beaf3bfb9fe5eca8ca6675c7c45b4b880db03..85041c38c8d2e84d780948a4dab94013ce39dfbe 100644
|
|
--- a/content/browser/renderer_host/navigation_request.cc
|
|
+++ b/content/browser/renderer_host/navigation_request.cc
|
|
@@ -10268,6 +10268,11 @@ void NavigationRequest::CreateWebUIIfNeeded(RenderFrameHostImpl* frame_host) {
|
|
bindings() != web_ui_->GetBindings()) {
|
|
RecordAction(base::UserMetricsAction("ProcessSwapBindingsMismatch_RVHM"));
|
|
base::WeakPtr<NavigationRequest> self = GetWeakPtr();
|
|
+ // Reset `controller` first before resetting `web_ui_`, since the controller
|
|
+ // still has a pointer to `web_ui_`, to avoid referencing to the already
|
|
+ // deleted `web_ui_` object from `controller`'s destructor. See also
|
|
+ // https://crbug.com/345640549.
|
|
+ controller.reset();
|
|
web_ui_.reset();
|
|
// Resetting the WebUI may indirectly call content's embedders and delete
|
|
// `this`. There are no known occurrences of it, so we assume this never
|