Fixes leak of WebContentsViewPort by
WebContentsViewGuest. WebContentsViewGuest needs to own the
WebContentsViewPort (no one else does). This lead to a use after free
(as seen in the bug).
BUG=236393
TEST=none
[email protected], [email protected]
Review URL: https://chromiumcodereview.appspot.com/18590009
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@210485 0039d316-1c4b-4281-b951-d872f2087c98
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 3842e88..0bcd2230 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -1222,13 +1222,11 @@
GetContentClient()->browser()->GetWebContentsViewDelegate(this);
if (browser_plugin_guest_) {
- // |render_view_host_delegate_view_| is a WebContentsView* and its
- // lifetime is managed by its associated WebContentsImpl.
- WebContentsViewPort* platform_view = CreateWebContentsView(
- this, delegate, &render_view_host_delegate_view_);
+ scoped_ptr<WebContentsViewPort> platform_view(CreateWebContentsView(
+ this, delegate, &render_view_host_delegate_view_));
WebContentsViewGuest* rv = new WebContentsViewGuest(
- this, browser_plugin_guest_.get(), platform_view,
+ this, browser_plugin_guest_.get(), platform_view.Pass(),
render_view_host_delegate_view_);
render_view_host_delegate_view_ = rv;
view_.reset(rv);
