chromium/src
0
Fork 0
Code Activity

Fix menu controller danlging ptr

Browse Source 
Menu controller can potentially outlive the menu host, which leads to a
memory leak when the window containing the menu host is suddenly closed.
This change explicitly calls ExitMenu to clean up menu controller's
internal state when the host is destroyed.

Change-Id: Ibbd32fbbe0fd9a69a83c31b9d01b5162e146738e
Fixed: 1462045
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4919607
Code-Coverage: findit-for-me@appspot.gserviceaccount.com <findit-for-me@appspot.gserviceaccount.com>
Reviewed-by: Allen Bauer <kylixrd@chromium.org>
Commit-Queue: Fred Shih <ffred@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1207334}
This commit is contained in:
Fred Shih
2023-10-09 22:25:57 +00:00
committed by Chromium LUCI CQ
parent 1d1faa377c
commit 40b65da1e0
2 changed files with 6 additions and 3 deletions
chrome/browser/ui/views/bookmarks
bookmark_menu_delegate.h
ui/views/controls/menu
menu_controller.cc

6
chrome/browser/ui/views/bookmarks/bookmark_menu_delegate.h

@ -188,11 +188,11 @@ class BookmarkMenuDelegate : public bookmarks::BaseBookmarkModelObserver,
// an id.
int GetAndIncrementNextMenuID();
const raw_ptr<Browser, LeakedDanglingUntriaged> browser_;
raw_ptr<Profile, LeakedDanglingUntriaged> profile_;
const raw_ptr<Browser> browser_;
raw_ptr<Profile> profile_;
// Parent of menus.
raw_ptr<views::Widget, LeakedDanglingUntriaged> parent_;
raw_ptr<views::Widget> parent_;
// Maps from menu id to BookmarkNode.
MenuIDToNodeMap menu_id_to_node_map_;

3
ui/views/controls/menu/menu_controller.cc

@ -1413,6 +1413,9 @@ void MenuController::OnWidgetDestroying(Widget* widget) {
owner_->RemoveObserver(this);
owner_ = nullptr;
native_view_for_gestures_ = nullptr;
// Exit menu to ensure that we are not holding on to resources when the
// widget has been destroyed.
ExitMenu();
}
bool MenuController::IsCancelAllTimerRunningForTest() {