Commit f4d74ffa authored by Miyoung Shin's avatar Miyoung Shin Committed by Commit Bot

Fix UAP in blink::ManifestManager's mojo binding

This CL resets own mojo binding in the internal function
of ManifestManager::ContextDestroyed because Blink's GC objects
that own mojo bindings manually need to reset the bindings to prevent
use after poison issue.

Bug: 979621
Change-Id: I38c4c3b532111f9ff721ef75b98d9e33a3f96441
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1705580Reviewed-by: default avatarKentaro Hara <haraken@chromium.org>
Reviewed-by: default avatarKen Rockot <rockot@google.com>
Commit-Queue: Miyoung Shin <myid.shin@igalia.com>
Cr-Commit-Position: refs/heads/master@{#678512}
parent bf7ae43a
...@@ -267,6 +267,8 @@ void ManifestManager::Dispose() { ...@@ -267,6 +267,8 @@ void ManifestManager::Dispose() {
// will be aware of the RenderFrame dying and should act on that. Consumers // will be aware of the RenderFrame dying and should act on that. Consumers
// in the renderer process should be correctly notified. // in the renderer process should be correctly notified.
ResolveCallbacks(ResolveStateFailure); ResolveCallbacks(ResolveStateFailure);
bindings_.CloseAllBindings();
} }
void ManifestManager::Trace(blink::Visitor* visitor) { void ManifestManager::Trace(blink::Visitor* visitor) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment