Commit ed80e872 authored by Christopher Cameron's avatar Christopher Cameron Committed by Commit Bot

Disable AvatarMenu in ExtensionAppShimHandler

The AvatarMenu is out-living ProfileAttributesStorage, and causing a
use after free. Disable its allocation for the moment.

There are a menu of follow-up fixes available:
- Ensure ExtensionAppShimHandler be terminated before
  ProfileAttributesStorage (and consider using a CheckedObserver
  instead of an UncheckedObserver).
- Make AvatarMenu use a weak pointer to ProfileAttributesStorage and
  allow ExtensionAppShimHandler to outlive ProfileAttributesStorage.

TBR=dominickn

Bug: 1008947
Change-Id: I0419c7427c4fd37c4a5fa583155ddf06ccf93d57
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1830917Reviewed-by: default avatarccameron <ccameron@chromium.org>
Commit-Queue: ccameron <ccameron@chromium.org>
Cr-Commit-Position: refs/heads/master@{#700989}
parent 1b728f8c
......@@ -262,9 +262,8 @@ bool ExtensionAppShimHandler::AppState::IsMultiProfile() const {
std::unique_ptr<AvatarMenu> ExtensionAppShimHandler::Delegate::CreateAvatarMenu(
AvatarMenuObserver* observer) {
ProfileManager* profile_manager = g_browser_process->profile_manager();
return std::make_unique<AvatarMenu>(
&profile_manager->GetProfileAttributesStorage(), observer, nullptr);
// TODO(https://crbug.com/1008947): Fix use-after-free caused by AvatarMenu.
return nullptr;
}
Profile* ExtensionAppShimHandler::Delegate::ProfileForPath(
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment