0
Files
src/content/browser
William Liu 3aef1d167c [DNT] Fix NavigationController raw_ptr during WebContents destruction
GetNavigationEntryScreenshotCache() asserts the frame tree is primary.
However during WebContents destruction, the frame tree is reset before
the animator, so the navigation controller (owned by the FrameTree) back
pointer is a UAF.

This CL adds a shortcut to destroy the animator as the "first" thing
during the WebContents's destruction. Then the animator can still
perform the clean up tasks while the navigation controller is still
valid.

Bug: 373898450
Change-Id: I0d793d536ca99700cf7f8c324f562131f2a480c4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5948024
Commit-Queue: William Liu <liuwilliam@chromium.org>
Reviewed-by: Dave Tapuska <dtapuska@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1372744}
2024-10-23 16:05:44 +00:00
..
2024-08-06 02:43:45 +00:00
2024-10-10 22:32:27 +00:00
2024-07-15 19:40:30 +00:00

This directory contains the core code needed for the browser process of a multi-process sandboxed browser.