diff options
| author | dmazzoni@chromium.org <dmazzoni@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-04-23 19:43:06 +0000 |
|---|---|---|
| committer | dmazzoni@chromium.org <dmazzoni@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-04-23 19:43:06 +0000 |
| commit | e20837b6ecc71fda917f726e0a5cddaaae997494 (patch) | |
| tree | 2f7b65ebe5b14d30209e01eb64572faaf4781a36 /content/browser/accessibility/browser_accessibility_manager_win.cc | |
| parent | 7dcb858349ca4aa8ac26357adda7de0441b01528 (diff) | |
| download | chromium_src-e20837b6ecc71fda917f726e0a5cddaaae997494.zip chromium_src-e20837b6ecc71fda917f726e0a5cddaaae997494.tar.gz chromium_src-e20837b6ecc71fda917f726e0a5cddaaae997494.tar.bz2 | |
Fix use-after-free of BrowserAccessibilityManagerWin::tracked_scroll_object_
BUG=232526
Review URL: https://chromiumcodereview.appspot.com/14426003
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@195882 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'content/browser/accessibility/browser_accessibility_manager_win.cc')
| -rw-r--r-- | content/browser/accessibility/browser_accessibility_manager_win.cc | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/content/browser/accessibility/browser_accessibility_manager_win.cc b/content/browser/accessibility/browser_accessibility_manager_win.cc index 76e78348..33e4614 100644 --- a/content/browser/accessibility/browser_accessibility_manager_win.cc +++ b/content/browser/accessibility/browser_accessibility_manager_win.cc @@ -63,6 +63,10 @@ void BrowserAccessibilityManagerWin::RemoveNode(BrowserAccessibility* node) { unique_id_to_renderer_id_map_.erase( node->ToBrowserAccessibilityWin()->unique_id_win()); BrowserAccessibilityManager::RemoveNode(node); + if (node == tracked_scroll_object_) { + tracked_scroll_object_->Release(); + tracked_scroll_object_ = NULL; + } } void BrowserAccessibilityManagerWin::NotifyAccessibilityEvent( |