3aef1d167c
GetNavigationEntryScreenshotCache() asserts the frame tree is primary. However during WebContents destruction, the frame tree is reset before the animator, so the navigation controller (owned by the FrameTree) back pointer is a UAF. This CL adds a shortcut to destroy the animator as the "first" thing during the WebContents's destruction. Then the animator can still perform the clean up tasks while the navigation controller is still valid. Bug: 373898450 Change-Id: I0d793d536ca99700cf7f8c324f562131f2a480c4 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5948024 Commit-Queue: William Liu <liuwilliam@chromium.org> Reviewed-by: Dave Tapuska <dtapuska@chromium.org> Cr-Commit-Position: refs/heads/main@{#1372744}
Chromium
Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.
The project's web site is https://www.chromium.org.
To check out the source code locally, don't use git clone! Instead,
follow the instructions on how to get the code.
Documentation in the source is rooted in docs/README.md.
Learn how to Get Around the Chromium Source Code Directory Structure.
For historical reasons, there are some small top level directories. Now the guidance is that new top level directories are for product (e.g. Chrome, Android WebView, Ash). Even if these products have multiple executables, the code should be in subdirectories of the product.
If you found a bug, please file it at https://crbug.com/new.