AutofillDownloadManager and CreditCardSaveManager require AutofillManger to live after frame deletion |
|
Issue descriptionAutofillDownloadManager and CreditCardSaveManager start asynchronous tasks on form submissions and task submission often triggers navigation and webframe deletion. These two classes are (intderectly) owned by AutofillManager which should live the same time as the web frame as documented in https://cs.chromium.org/chromium/src/components/autofill/core/browser/autofill_manager.h?q=autofill_manager&sq=package:chromium&g=0&l=67 https://cs.chromium.org/chromium/src/components/autofill/content/browser/content_autofill_driver_factory.cc?sq=package:chromium&g=0&l=133 This can lead to two kind of bugs: - if the frame is deleted before the asynchronous job is finished, the job will not complete - on job completion, the AutofillDownloadManager and CreditCardSaveManager can access web frame data which has already been destroyed. |
|
►
Sign in to add a comment |
|