Fix use after free in JavascriptAppModalDialogAndroid.

On Android JavascriptAppModalDialog is implemented with a Java class and its
native counterpart.
The Java class holds a pointer to the native instance. When UI events (e.g.
button click) are processed, the Java side calls a native method (e.g.
JavascriptAppModalDialog::DidAcceptAppModalDialog()). When this native method
completes the instance deletes itself.
This is only correct in case it is guaranteed that no further native method
call is performed by the Java side since the pointer was freed.
The problem is that this can happen in some rare circumstances. For instance
the user could manage to click on two buttons before the dialog is closed which
might happen if the first click event is not processed immediately or takes a
long time to be processed.

This CL fixes the crash by invalidating the native pointer on the Java side
when it is deleted so that the Java side can perform a native method call only
if the native instance pointer is still valid.

BUG=167585

Review URL: https://codereview.chromium.org/11728004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@175139 0039d316-1c4b-4281-b951-d872f2087c98

0 files changed, 0 insertions, 0 deletions