commit fb1a33759734581e53cdbffa25f52d41b91549b3
author Pavel Yatsuk <pavely@google.com> Thu Oct 15 18:35:28 2020
committer Commit Bot <commit-bot@chromium.org> Thu Oct 15 18:35:28 2020
tree 4311bc57b9218830a74f33cd8a90fb9984261786
parent 3292212f527e21c5b4f7c8b57c716b7bd08956df

Avoid use-after-free of InfoBarAndroid from pointer in InfoBar.java

InfoBar.java has a native reference to InfoBarAndroid which should be
cleared before InfoBarAndroid is destroyed. Calls to
java_info_bar_.Reset() without corresponding onNativeDestroyed() or
setNativeInfobar() allow scenarios where java InfoBar still has non-null
pointer after native object was destroyed. This results in occasional
use-after-free.

This CL:
- renames onNativeDestroyed method to resetNativeInfoBar to indicate
  that it is not necessarily called when native is destroyed, but in
  general when native-java association changes.
- adds a call to reset native infobar into CloseJavaInfoBar to prevent
  java infobar from referring potentially destroyed native object.
- removes unused ReassignJavaInfoBar().

BUG=1135130
R=​mdjones@chromium.org

(cherry picked from commit eec1d10023f3c39c830a6f9df5fdc4f90f937749)

Change-Id: I1329ed6a78cc589d8f23df883a8fcb60689230a2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2459268
Reviewed-by: Colin Blundell <blundell@chromium.org>
Reviewed-by: Matthew Jones <mdjones@chromium.org>
Commit-Queue: Pavel Yatsuk <pavely@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#816281}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2476714
Reviewed-by: Pavel Yatsuk <pavely@chromium.org>
Cr-Commit-Position: refs/branch-heads/4280@{#416}
Cr-Branched-From: ea420fb963f9658c9969b6513c56b8f47efa1a2a-refs/heads/master@{#812852}