| commit | 483bfc1db9c72d4f947adcee10428cebdacd9030 | |
| author | sky@chromium.org <sky@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | |
| Tue, 12 Aug 2014 01:28:29 +0000 (12 01:28 +0000) | ||
| committer | sky@chromium.org <sky@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | |
| Tue, 12 Aug 2014 01:29:55 +0000 (12 01:29 +0000) | ||
| tree | aedb3a6d87dce9111bb6889ae8ab15652960dfff | treesnapshot (tar.gz zip) |
| parent | 7aee4f7e25514337a82994977c2a57d58a6991ca | commitdiff |
Fixes bug in GinJavaBridgeDispatcherHost
My try job kept failing on android and I finally tracked it down to
this code. GinJavaBridgeDispatcherHost::RemoveNamedObject may be
invoked with a value that comes from named_objects_ (see
AddNamedObject). RemoveNamedObject removes from named_object_ and then
uses the passed in value. If this happens |name| is no longer valid
and shouldn't be used.
BUG=none
TEST=none
R=mnaganov@chromium.org
TBR=mnaganov@chromium.org
Review URL: https://codereview.chromium.org/455833005
Cr-Commit-Position: refs/heads/master@{#288861}
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@288861 0039d316-1c4b-4281-b951-d872f2087c98
My try job kept failing on android and I finally tracked it down to
this code. GinJavaBridgeDispatcherHost::RemoveNamedObject may be
invoked with a value that comes from named_objects_ (see
AddNamedObject). RemoveNamedObject removes from named_object_ and then
uses the passed in value. If this happens |name| is no longer valid
and shouldn't be used.
BUG=none
TEST=none
R=mnaganov@chromium.org
TBR=mnaganov@chromium.org
Review URL: https://codereview.chromium.org/455833005
Cr-Commit-Position: refs/heads/master@{#288861}
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@288861 0039d316-1c4b-4281-b951-d872f2087c98
| content/browser/android/java/gin_java_bridge_dispatcher_host.cc | diffblobblamehistory |