Skip to content

Commit 45c89b0

Browse files
author
Vasilii Sukhanov
committed
Fix NULL pointer dereferncing in AccountChooserDialogView.
The fix is for 3 different crashes. - AccountChooserDialogView::ControllerGone can trigger some accessibility events. The framework needs the title of the dialog. As a result the controller is dereferenced. - AccountChooserDialogView::ButtonPressed and AccountChooserDialogView::StyledLabelLinkClicked. On Mac those events may be triggered when the dialog already disappeared. Therefore, a NULL-check is required before pinging the controller. [email protected] (cherry picked from commit 1fde9e5) Bug: 792731 Change-Id: Ia177aaa8ace746164ff363ecac94761c3f8f3dc6 Reviewed-on: https://chromium-review.googlesource.com/951002 Commit-Queue: Vasilii Sukhanov <[email protected]> Reviewed-by: Vaclav Brozek <[email protected]> Cr-Original-Commit-Position: refs/heads/master@{#541100} Reviewed-on: https://chromium-review.googlesource.com/955562 Reviewed-by: Vasilii Sukhanov <[email protected]> Cr-Commit-Position: refs/branch-heads/3359@{#93} Cr-Branched-From: 66afc5e-refs/heads/master@{#540276}
1 parent 0bbd673 commit 45c89b0

File tree

1 file changed

+14
-5
lines changed

1 file changed

+14
-5
lines changed

chrome/browser/ui/views/passwords/account_chooser_dialog_view.cc

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -109,8 +109,10 @@ void AccountChooserDialogView::ShowAccountChooser() {
109109
}
110110

111111
void AccountChooserDialogView::ControllerGone() {
112-
controller_ = nullptr;
112+
// During Widget::Close() phase some accessibility event may occur. Thus,
113+
// |controller_| should be kept around.
113114
GetWidget()->Close();
115+
controller_ = nullptr;
114116
}
115117

116118
ui::ModalType AccountChooserDialogView::GetModalType() const {
@@ -170,15 +172,22 @@ base::string16 AccountChooserDialogView::GetDialogButtonLabel(
170172
void AccountChooserDialogView::StyledLabelLinkClicked(views::StyledLabel* label,
171173
const gfx::Range& range,
172174
int event_flags) {
173-
controller_->OnSmartLockLinkClicked();
175+
// On Mac the button click event may be dispatched after the dialog was
176+
// hidden. Thus, the controller can be NULL.
177+
if (controller_)
178+
controller_->OnSmartLockLinkClicked();
174179
}
175180

176181
void AccountChooserDialogView::ButtonPressed(views::Button* sender,
177182
const ui::Event& event) {
178183
CredentialsItemView* view = static_cast<CredentialsItemView*>(sender);
179-
controller_->OnChooseCredentials(
180-
*view->form(),
181-
password_manager::CredentialType::CREDENTIAL_TYPE_PASSWORD);
184+
// On Mac the button click event may be dispatched after the dialog was
185+
// hidden. Thus, the controller can be NULL.
186+
if (controller_) {
187+
controller_->OnChooseCredentials(
188+
*view->form(),
189+
password_manager::CredentialType::CREDENTIAL_TYPE_PASSWORD);
190+
}
182191
}
183192

184193
void AccountChooserDialogView::InitWindow() {

0 commit comments

Comments
 (0)