• Kent Tamura's avatar
    Fix use-after-free of TestRunner::main_view_ · 5dc8f826
    Kent Tamura authored
    test_runner::TestRunner::WorkQueue::ProcessWork() can run after the
    main WebView destruction, and we have to clear main_view_ when the
    WebView is destructed.
    
    The code assumed TestInterfaces::WindowClosed() cleared main_view_
    if the closing WebView is the main WebView. However,
    |proxy->webview()| is already null here because WebView is destructed
    before calling WindowClosed().
    
    This CL adds SetMainView(nullptr) to ~WebViewTestProxy(). It is called
    if the global delegate is same as the delegate owned by the
    WebViewTestProxy. This condition is equivalent to 'this
    WebViewTestProxy is the owner of the main WebView.'
    
    Bug: 1010581
    Change-Id: I868ce9223d253dbf02620fdebff8ada4a51c60d7
    Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1865734Reviewed-by: default avatarMike West <mkwst@chromium.org>
    Commit-Queue: Kent Tamura <tkent@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#707717}
    5dc8f826
web_view_test_proxy.cc 4.18 KB