Commit b7915657 authored by Daniel Murphy's avatar Daniel Murphy Committed by Commit Bot

Crash Fix: SiteDataDeleteHelper memory corruption

CookiesTreeModel::MaybeNotifyBatchesEnded sets some member variables
after calling TreeModelEndBatch on the observers, but our observer
deletes the CookiesTreeModel object, resulting in memory corruption.

Bug: 766752
Change-Id: I970da0ce1afd829f06d7362ba135c5560ddbff88
Reviewed-on: https://chromium-review.googlesource.com/723788Reviewed-by: default avatarBernhard Bauer <bauerb@chromium.org>
Commit-Queue: Daniel Murphy <dmurph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#509510}
parent 10247e9f
...@@ -588,7 +588,7 @@ class SiteDataDeleteHelper : ...@@ -588,7 +588,7 @@ class SiteDataDeleteHelper :
RecursivelyFindSiteAndDelete(cookies_tree_model_->GetRoot()); RecursivelyFindSiteAndDelete(cookies_tree_model_->GetRoot());
// This will result in this class getting deleted. // This will result in this class getting deleted.
Release(); BrowserThread::ReleaseSoon(BrowserThread::UI, FROM_HERE, this);
} }
void RecursivelyFindSiteAndDelete(CookieTreeNode* node) { void RecursivelyFindSiteAndDelete(CookieTreeNode* node) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment