diff options
| author | Allan Sandfeld Jensen <allan.jensen@qt.io> | 2018-10-24 14:51:03 +0200 |
|---|---|---|
| committer | Allan Sandfeld Jensen <allan.jensen@qt.io> | 2019-03-27 14:54:56 +0000 |
| commit | e2b165f457946c6cd2d6ba0f85ff3cc03b3709e1 (patch) | |
| tree | c863b48e791ff0b88ce8cd81786a01e3ef9c481d | |
| parent | 13704549b84a86e894d707a97cfe2ad15a86f30c (diff) | |
[Backport] Fix for CVE-2018-17462
Refcount AppCacheGroup correctly.
TBR=palmer@chromium.org
(cherry picked from commit 9d2ead1650a1c901754dd1a68705006a6934cffc)
Bug: 888926
Change-Id: Iab0d82d272e2f24a5e91180d64bc8e2aa8a8238d
Reviewed-on: https://chromium-review.googlesource.com/1246827
Reviewed-by: Marijn Kruisselbrink <mek@chromium.org>
Reviewed-by: Joshua Bell <jsbell@chromium.org>
Commit-Queue: Chris Palmer <palmer@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#594475}
Reviewed-on: https://chromium-review.googlesource.com/1252004
Cr-Commit-Position: refs/branch-heads/3538@{#733}
Cr-Branched-From: 79f7c91a2b2a2932cd447fa6f865cb6662fa8fa6-refs/heads/master@{#587811}
Reviewed-by: Michal Klocek <michal.klocek@qt.io>
| -rw-r--r-- | chromium/content/browser/appcache/appcache_group.cc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/chromium/content/browser/appcache/appcache_group.cc b/chromium/content/browser/appcache/appcache_group.cc index 573983eba6e..4dcb3845524 100644 --- a/chromium/content/browser/appcache/appcache_group.cc +++ b/chromium/content/browser/appcache/appcache_group.cc @@ -114,9 +114,9 @@ void AppCacheGroup::AddCache(AppCache* complete_cache) { void AppCacheGroup::RemoveCache(AppCache* cache) { DCHECK(cache->associated_hosts().empty()); if (cache == newest_complete_cache_) { - CancelUpdate(); AppCache* tmp_cache = newest_complete_cache_; newest_complete_cache_ = NULL; + CancelUpdate(); tmp_cache->set_owning_group(NULL); // may cause this group to be deleted } else { scoped_refptr<AppCacheGroup> protect(this); |