commit | 5145254581a162ae9ad9c1f4f77d54a23c30af86 | [log] [tgz] |
---|---|---|
author | John Kleinschmidt <kleinschmidtorama@gmail.com> | Thu Aug 01 01:29:14 2019 |
committer | Commit Bot <commit-bot@chromium.org> | Thu Aug 01 01:29:14 2019 |
tree | c9f0cefd7b5906e5627429e579ebfd8ae55ccd6a | |
parent | 625d0a90c1d4346293d79521a70486b62c72384b [diff] |
fix heap-use-after-free when aborting an animation Under certain circumstances, such as aborting an animation and then reassigning a unique_ptr to a new CallbackLayerAnimationObserver (eg InkDropRipple::SnapToState(InkDropState ink_drop_state), the logic to detect deletion in CallbackLayerAnimationObserver ends up causing a heap-use-after-free because CallbackLayerAnimationObserver::CheckAllSequencesCompleted() overwrites the destroyed_ pointer that CallbackLayerAnimationObserver::SetActive() set. In order to fix this issue, use of the destroyed_ pointer was replaced with local WeakPtrs in order to detect deletion. Change-Id: I051657fae929eb4d7200f965561e9d9fb21b44f5 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1714626 Reviewed-by: kylechar <kylechar@chromium.org> Commit-Queue: Jeremy Apthorp <jeremya@chromium.org> Cr-Commit-Position: refs/heads/master@{#683029}
Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.
The project's web site is https://www.chromium.org.
Documentation in the source is rooted in docs/README.md.
Learn how to Get Around the Chromium Source Code Directory Structure .