New issue
Advanced search Search tips

Issue 892612 link

Starred by 1 user

Issue metadata

Status: Untriaged
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: iOS
Pri: 2
Type: Bug



Sign in to add a comment

AutofillDownloadManager and CreditCardSaveManager require AutofillManger to live after frame deletion

Project Member Reported by olivierrobin@chromium.org, Oct 5

Issue description

AutofillDownloadManager and CreditCardSaveManager start asynchronous tasks on form submissions and task submission often triggers navigation and webframe deletion.

These two classes are (intderectly) owned by AutofillManager which should live the same time as the web frame as documented in

https://cs.chromium.org/chromium/src/components/autofill/core/browser/autofill_manager.h?q=autofill_manager&sq=package:chromium&g=0&l=67

https://cs.chromium.org/chromium/src/components/autofill/content/browser/content_autofill_driver_factory.cc?sq=package:chromium&g=0&l=133

This can lead to two kind of bugs:
- if the frame is deleted before the asynchronous job is finished, the job will not complete
- on job completion, the AutofillDownloadManager and CreditCardSaveManager can access web frame data which has already been destroyed.
 

Sign in to add a comment