| commit | d366835eb8b1f363efbbabc035b233714c6083a1 | [log] [tgz] |
|---|---|---|
| author | Ehsan Karamad <[email protected]> | Tue Feb 12 16:57:59 2019 |
| committer | Commit Bot <[email protected]> | Tue Feb 12 16:57:59 2019 |
| tree | 3fb42c7e432142846b9db1be17e9f49ffc319875 | |
| parent | 6f96b9d2641f608adb2ef06717a586c5157a2f7e [diff] |
[ MimeHandlerView ] Fix a crash in FrameContainer MimeHandlerViewFrameContainer is not observing the lifetime of its embedder RenderFrame. This could cause a crash when the renderer (embedder) sets an <iframe>'s source to a PDF type and then removes the frame sometime later. The RenderFrame is deleted instantly but MHVFC is removed after the IPC round-trip: RenderFrameProxy associated with MHVFC is removed, this destroys guest which will notify the MHVFC to delete itself. At this point MHVFC cannot find its RenderFrame and is not removed from the global map. This CL adds a lifetime observer helper class which clears MHVFC from global map as soon as the embedder frame goes away. This is similar to what GuestViewContainer does. Bug: 930803 Change-Id: Ieedda08d79cc7c9ef703b371e4ffe08337a8cc5f Reviewed-on: https://chromium-review.googlesource.com/c/1465065 Commit-Queue: Ehsan Karamad <[email protected]> Reviewed-by: James MacLean <[email protected]> Cr-Commit-Position: refs/heads/master@{#631269}
ChromiumChromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.
The project's web site is https://www.chromium.org.
Documentation in the source is rooted in docs/README.md.
Learn how to Get Around the Chromium Source Code Directory Structure .