| commit | d4b7c865e31c067194da6a2e71ed03e418a66e42 | |
| author | benjhayden@chromium.org <benjhayden@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | |
| Wed, 20 Nov 2013 21:18:46 +0000 (20 21:18 +0000) | ||
| committer | benjhayden@chromium.org <benjhayden@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | |
| Wed, 20 Nov 2013 21:18:46 +0000 (20 21:18 +0000) | ||
| tree | 5a63fe0a5f7760c308bb6e4c0dc5736d7f09cef6 | treesnapshot (tar.gz zip) |
| parent | a23710462b302c48e6c32d7e50f9a92cbb33da8d | commitdiff |
Fix a crash when chrome.downloads.removeFile called on invalid download.
If the DownloadsRemoveFileFunction constructor doesn't explicitly set item_=NULL, then it's set to non-NULL garbage. If the item id passed to removeFile is invalid, then item_ is not set to a live DownloadItem*, so that non-NULL garbage is dereferenced in the destructor item_->RemoveObserver(this).
Re-enable tests on mac and linux since flakiness was only reported on windows.
BUG=319984,306144
Review URL: https://codereview.chromium.org/76393004
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@236294 0039d316-1c4b-4281-b951-d872f2087c98
If the DownloadsRemoveFileFunction constructor doesn't explicitly set item_=NULL, then it's set to non-NULL garbage. If the item id passed to removeFile is invalid, then item_ is not set to a live DownloadItem*, so that non-NULL garbage is dereferenced in the destructor item_->RemoveObserver(this).
Re-enable tests on mac and linux since flakiness was only reported on windows.
BUG=319984,306144
Review URL: https://codereview.chromium.org/76393004
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@236294 0039d316-1c4b-4281-b951-d872f2087c98
| chrome/browser/extensions/api/downloads/downloads_api.cc | diffblobblamehistory | |
| chrome/browser/extensions/api/downloads/downloads_api_browsertest.cc | diffblobblamehistory |