Commit 43c81814 authored by Scott Violet's avatar Scott Violet Committed by Commit Bot

tab_hover_card: set anchor_view_ to null when stopping animation

This isn't necessarily a problem right now, but without this it's
entirely possible that WidgetSlideAnimationDelegate is holding a
reference to a deleted view, which makes me nervous.

I came across this when looking at a crash that was the result of a UAF
that I suspect was in this code. I believe you've since fixed it.

BUG=940322
TEST=none

Change-Id: Icfacdb7533ab9d1e8b2d99cbb29b459e2a21445a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1627654Reviewed-by: default avatarCaroline Rising <corising@chromium.org>
Commit-Queue: Scott Violet <sky@chromium.org>
Cr-Commit-Position: refs/heads/master@{#662754}
parent 53554355
...@@ -232,7 +232,10 @@ class TabHoverCardBubbleView::WidgetSlideAnimationDelegate ...@@ -232,7 +232,10 @@ class TabHoverCardBubbleView::WidgetSlideAnimationDelegate
slide_animation_->Show(); slide_animation_->Show();
} }
void StopAnimation() { slide_animation_->Stop(); } void StopAnimation() {
anchor_view_ = nullptr;
slide_animation_->Stop();
}
bool IsAnimating() { return slide_animation_->is_animating(); } bool IsAnimating() { return slide_animation_->is_animating(); }
...@@ -251,10 +254,12 @@ class TabHoverCardBubbleView::WidgetSlideAnimationDelegate ...@@ -251,10 +254,12 @@ class TabHoverCardBubbleView::WidgetSlideAnimationDelegate
TabHoverCardBubbleView* const bubble_delegate_; TabHoverCardBubbleView* const bubble_delegate_;
std::unique_ptr<gfx::SlideAnimation> slide_animation_; std::unique_ptr<gfx::SlideAnimation> slide_animation_;
views::View* anchor_view_; views::View* anchor_view_ = nullptr;
gfx::Rect starting_bubble_bounds_; gfx::Rect starting_bubble_bounds_;
gfx::Rect target_bubble_bounds_; gfx::Rect target_bubble_bounds_;
gfx::Rect current_bubble_bounds_; gfx::Rect current_bubble_bounds_;
DISALLOW_COPY_AND_ASSIGN(WidgetSlideAnimationDelegate);
}; };
TabHoverCardBubbleView::TabHoverCardBubbleView(Tab* tab) TabHoverCardBubbleView::TabHoverCardBubbleView(Tab* tab)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment