Fix PermissionObserver OOB access crash
This change fixes a crash caused by an OOB access from the |chooser_observer_| when removing the observer upon the destruction of SiteSettingsHandler. The crash occurs when the following conditions are met. 1. An off the record profile is created. 2. A chooser permission is granted in the off the record profile. 3. The chrome://settings/content page is opened in the main profile window. 4. The off the record window is closed. 5. The chrome://settings/content page is closed. The SiteSettingsHandler will attempt to remove itself from the off the record ChooserContextBase upon destruction, but the off the record ChooserContextBase was already destroyed previously, therefore accessing memory that has already been freed. This change removes the logic that adds the SiteSettingsHandler to the off the record ChooserContextBase, since the UI does not actually display off the record chooser permissions anyways. I created https://crbug.com/927372 for adding this feature. Bug: 926501 Change-Id: I87359a3d67020a80b9fb698d5252c320436317de Reviewed-on: https://chromium-review.googlesource.com/c/1447312Reviewed-by:Dan Beam <dbeam@chromium.org> Commit-Queue: Ovidio de Jesús Ruiz-Henríquez <odejesush@chromium.org> Cr-Commit-Position: refs/heads/master@{#628468}
Showing
Please register or sign in to comment