Commit af5c4bc1 authored by Matthew Denton's avatar Matthew Denton Committed by Commit Bot

Fix message_center::MessageView::OnSlideOut UAF

Bug: 983009
Change-Id: Ie285c4035bfc4c45e27e5f3fd6c34280d9f4c2d2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2001943Reviewed-by: default avatarPeter Beverloo <peter@chromium.org>
Commit-Queue: Matthew Denton <mpdenton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#732131}
parent 9a4cdbeb
...@@ -348,11 +348,12 @@ void MessageView::RemoveSlideObserver(MessageView::SlideObserver* observer) { ...@@ -348,11 +348,12 @@ void MessageView::RemoveSlideObserver(MessageView::SlideObserver* observer) {
} }
void MessageView::OnSlideOut() { void MessageView::OnSlideOut() {
MessageCenter::Get()->RemoveNotification(notification_id_,
true /* by_user */);
for (auto& observer : slide_observers_) for (auto& observer : slide_observers_)
observer.OnSlideOut(notification_id_); observer.OnSlideOut(notification_id_);
// RemoveNotification() may delete |this|.
MessageCenter::Get()->RemoveNotification(notification_id_,
true /* by_user */);
} }
void MessageView::OnWillChangeFocus(views::View* before, views::View* now) {} void MessageView::OnWillChangeFocus(views::View* before, views::View* now) {}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment