diff options
| author | reillyg <reillyg@chromium.org> | 2014-12-12 17:30:11 -0800 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2014-12-13 01:30:28 +0000 |
| commit | accea33ab9847b38b96bfe50c85b27148e76cde1 (patch) | |
| tree | c1e808101147e54d223f91b62e4645ec59ded44b /extensions/browser/extension_function_dispatcher.cc | |
| parent | f9c458fb8d7b47305dd9e484c49704ca5577054a (diff) | |
| download | chromium_src-accea33ab9847b38b96bfe50c85b27148e76cde1.zip chromium_src-accea33ab9847b38b96bfe50c85b27148e76cde1.tar.gz chromium_src-accea33ab9847b38b96bfe50c85b27148e76cde1.tar.bz2 | |
Possible fix for ExtensionFunctionDispatcher::DispatchWithCallbackInternal.
This is a possible fix for crashes observed in this function. The member
variable browser_context_ is possibly invalid because the object may
be freed by function->Run(). To avoid this we move the call to
ProcessManager::Get() to before where function->Run() is called.
BUG=441679
Review URL: https://codereview.chromium.org/798103002
Cr-Commit-Position: refs/heads/master@{#308214}
Diffstat (limited to 'extensions/browser/extension_function_dispatcher.cc')
| -rw-r--r-- | extensions/browser/extension_function_dispatcher.cc | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/extensions/browser/extension_function_dispatcher.cc b/extensions/browser/extension_function_dispatcher.cc index b3f3043..31d1e49 100644 --- a/extensions/browser/extension_function_dispatcher.cc +++ b/extensions/browser/extension_function_dispatcher.cc @@ -378,6 +378,9 @@ void ExtensionFunctionDispatcher::DispatchWithCallbackInternal( return; } + // Fetch the ProcessManager before |this| is possibly invalidated. + ProcessManager* process_manager = ProcessManager::Get(browser_context_); + ExtensionSystem* extension_system = ExtensionSystem::Get(browser_context_); QuotaService* quota = extension_system->quota_service(); std::string violation_error = quota->Assess(extension->id(), @@ -410,7 +413,7 @@ void ExtensionFunctionDispatcher::DispatchWithCallbackInternal( // now, largely for simplicity's sake. This is OK because currently, only // the webRequest API uses IOThreadExtensionFunction, and that API is not // compatible with lazy background pages. - ProcessManager::Get(browser_context_)->IncrementLazyKeepaliveCount(extension); + process_manager->IncrementLazyKeepaliveCount(extension); } void ExtensionFunctionDispatcher::OnExtensionFunctionCompleted( |