Skip to content

GitLab

T
tangled
Switch branch/tag
Find file BlameHistoryPermalink
  • ananta@chromium.org's avatar
    Fix a use after free crasher in the BrowserAccessibilityManagerWinTest.TestAccessibleHWND test. · 48476970
    ananta@chromium.org authored 
    The crash occurs because a scoped_ptr instance which holds the TestLegacyRenderWidgetHostHWND class
is left with a dangling pointer to the LegacyRenderWidgetHostHWND instance which is destroyed via
DestroyWindow.

Fix is to first reset the scoped_ptr which in turn destroys the legacy window and the instance.
The DestroyWindow call is removed as it is not needed anymore.

I also added a call to the CreateATLModuleIfNeeded helper function in BrowserAccessibility::Create as I was
hitting a crash due to a NULL AtlModule. We do this already in the ctor of the BrowserAccessibilityManagerWin
class. However that is too late as we have base classes which create COM objects.

This crash only happens in the component builds.

BUG=393228

Review URL: https://codereview.chromium.org/383263002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@282759 0039d316-1c4b-4281-b951-d872f2087c98
    48476970
browser_accessibility_win_unittest.cc 25.9 KB