• Ovidio Henriquez's avatar
    Fix PermissionObserver OOB access crash · 15a43eca
    Ovidio Henriquez authored
    This change fixes a crash caused by an OOB access from the
    |chooser_observer_| when removing the observer upon the destruction of
    SiteSettingsHandler. The crash occurs when the following conditions are
    met.
    
    1. An off the record profile is created.
    2. A chooser permission is granted in the off the record profile.
    3. The chrome://settings/content page is opened in the main profile
       window.
    4. The off the record window is closed.
    5. The chrome://settings/content page is closed.
    
    The SiteSettingsHandler will attempt to remove itself from the off the
    record ChooserContextBase upon destruction, but the off the record
    ChooserContextBase was already destroyed previously, therefore accessing
    memory that has already been freed.
    
    This change removes the logic that adds the SiteSettingsHandler to the
    off the record ChooserContextBase, since the UI does not actually
    display off the record chooser permissions anyways. I created
    https://crbug.com/927372 for adding this feature.
    
    Bug: 926501
    Change-Id: I87359a3d67020a80b9fb698d5252c320436317de
    Reviewed-on: https://chromium-review.googlesource.com/c/1447312Reviewed-by: default avatarDan Beam <dbeam@chromium.org>
    Commit-Queue: Ovidio de Jesús Ruiz-Henríquez <odejesush@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#628468}
    15a43eca
site_settings_handler.cc 54.3 KB