diff options
| author | Wez <wez@chromium.org> | 2021-04-15 18:24:27 +0000 |
|---|---|---|
| committer | Michael Brüning <michael.bruning@qt.io> | 2021-04-21 10:48:47 +0000 |
| commit | 5dc9d788f583a3685fa80315c194aa6d5f0b1a28 (patch) | |
| tree | 229ceadc5b2c40b7122fa30cb9761fac0e3b9178 | |
| parent | 0cf8a1fb9846d3ad80a39e5f0a650f5926483748 (diff) | |
[Backport] Security bug 1192552
Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/2826321:
[views] Handle window deletion during HandleDisplayChange.
In principle there is no reason why the HWNDMessageHandler shouldn't be
deleted by a HandleDisplayChange() call out to the delegate, e.g. if the
change results in a change in window layout.
(cherry picked from commit 299155e5e37a77670b7969771e09e9a16b1f5612)
Bug: 1192552
Change-Id: I9fca35ff32e7037c6492f4cee7069e272059b920
Auto-Submit: Wez <wez@chromium.org>
Commit-Queue: Scott Violet <sky@chromium.org>
Reviewed-by: Scott Violet <sky@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#869603}
Cr-Commit-Position: refs/branch-heads/4430@{#1291}
Cr-Branched-From: e5ce7dc4f7518237b3d9bb93cccca35d25216cbe-refs/heads/master@{#857950}
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
| -rw-r--r-- | chromium/ui/views/win/hwnd_message_handler.cc | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/chromium/ui/views/win/hwnd_message_handler.cc b/chromium/ui/views/win/hwnd_message_handler.cc index 754528f7d28..d2f0a524832 100644 --- a/chromium/ui/views/win/hwnd_message_handler.cc +++ b/chromium/ui/views/win/hwnd_message_handler.cc @@ -1661,7 +1661,13 @@ void HWNDMessageHandler::OnDisplayChange(UINT bits_per_pixel, const gfx::Size& screen_size) { TRACE_EVENT0("ui", "HWNDMessageHandler::OnDisplayChange"); + base::WeakPtr<HWNDMessageHandler> ref(msg_handler_weak_factory_.GetWeakPtr()); delegate_->HandleDisplayChange(); + + // HandleDisplayChange() may result in |this| being deleted. + if (!ref) + return; + // Force a WM_NCCALCSIZE to occur to ensure that we handle auto hide // taskbars correctly. SendFrameChanged(); |