diff options
| author | shess@chromium.org <shess@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-02-08 01:30:29 +0000 |
|---|---|---|
| committer | shess@chromium.org <shess@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-02-08 01:30:29 +0000 |
| commit | 93be387bbb8be4396da7225d8cf2ab6575f1d407 (patch) | |
| tree | e785337ac5423cc690c5d19eeda20fa0ff7f64a7 /chrome_frame/bho.cc | |
| parent | 0c9406639ed7eadded6d93a3b6e83e4a7e1e2458 (diff) | |
| download | chromium_src-93be387bbb8be4396da7225d8cf2ab6575f1d407.zip chromium_src-93be387bbb8be4396da7225d8cf2ab6575f1d407.tar.gz chromium_src-93be387bbb8be4396da7225d8cf2ab6575f1d407.tar.bz2 | |
[Mac] Fix use-after-free in hung renderer dialog.
If renderer activity causes the dialog to be dismissed while the user
is in the process of clicking one of the buttons, the nested loop can
process the autorelease pool the controller is in. Then when the user
releases the mouse button the message goes to a zombie.
The hungContents_ case can happen if the user does not move the mouse
when this happens. In that case the controller will still be alive to
forward the kill.
BUG=129827
Review URL: https://chromiumcodereview.appspot.com/12218021
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@181398 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'chrome_frame/bho.cc')
0 files changed, 0 insertions, 0 deletions