diff options
| author | mkosiba@chromium.org <mkosiba@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2012-12-05 14:32:43 +0000 |
|---|---|---|
| committer | mkosiba@chromium.org <mkosiba@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2012-12-05 14:32:43 +0000 |
| commit | 24a369ffb1613c03abb4d1e7097e94e9389dd874 (patch) | |
| tree | 8a19bdbd324c16e72dd009c96da9d0b4edf2ffd9 /content/renderer/java/java_bridge_channel.h | |
| parent | 6d00b3cf12d74d2dfa414aa7e4b4eac903d313d4 (diff) | |
| download | chromium_src-24a369ffb1613c03abb4d1e7097e94e9389dd874.zip chromium_src-24a369ffb1613c03abb4d1e7097e94e9389dd874.tar.gz chromium_src-24a369ffb1613c03abb4d1e7097e94e9389dd874.tar.bz2 | |
Fix crash in JavaBridgeDispatcher::OnAddNamedObject.
This crash is possible if a WebContents is created, an object is
added to the bridge and the WebContents is then destroyed. If the
timing is right the channel_.get() method returns NULL in that case
and a crash occurs.
BUG=None
Review URL: https://chromiumcodereview.appspot.com/11421175
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@171215 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'content/renderer/java/java_bridge_channel.h')
| -rw-r--r-- | content/renderer/java/java_bridge_channel.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/content/renderer/java/java_bridge_channel.h b/content/renderer/java/java_bridge_channel.h index 5151a69..c6bf8d3 100644 --- a/content/renderer/java/java_bridge_channel.h +++ b/content/renderer/java/java_bridge_channel.h @@ -12,6 +12,7 @@ namespace content { class JavaBridgeChannel : public content::NPChannelBase { public: + // The return value may be null. static JavaBridgeChannel* GetJavaBridgeChannel( const IPC::ChannelHandle& channel_handle, base::MessageLoopProxy* ipc_message_loop); |