• Nick Diego Yamane's avatar
    x11: Fix UAF crash in XWindow's delayed resize task execution · 9212a37e
    Nick Diego Yamane authored
    XWindow can be destroyed in the middle of a delayed resize closure
    execution. It may happen when that window is snapped into a tab bar.
    More specifically when a nested move loop, used to intercept and forward
    the mouse events during a tab dragging session, is triggered by a bounds
    change event notified from a delayed resize task.
    
    To fix it, this uses a weak pointer to verify whether the window
    instance is still alive after notifying the bounds change in the delayed
    resize function implementation.
    
    Bug: 1068755, 1021490
    Change-Id: I08eff38d5f5f28ec54e489dc183f3f0cfdde2480
    Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2144996Reviewed-by: default avatarThomas Anderson <thomasanderson@chromium.org>
    Commit-Queue: Nick Yamane <nickdiego@igalia.com>
    Cr-Commit-Position: refs/heads/master@{#758552}
    9212a37e
x11_window.cc 57.4 KB