From 645d1b92c159853dd18475529209fe83b205e8c2 Mon Sep 17 00:00:00 2001 From: Claudio DeSouza Date: Wed, 22 Apr 2026 13:25:35 +0100 Subject: [PATCH] [cr149][WIP] `ReadingListPageHandler` has `WebContentsObserver` The brave version of this class was using this observer, but now that base class has introduced it, we can just rely on that. Chromium changes: https://chromium.googlesource.com/chromium/src/+/68cc838450946381bec6c1c777ede5494715f608 commit 68cc838450946381bec6c1c777ede5494715f608 Author: Foromo Daniel Soromou Date: Tue Apr 21 08:04:31 2026 -0700 [Side Panel] Fix dangling WebContents pointer in ReadingListPageHandler This patch resolves a dangling pointer issue in ReadingListPageHandler by replacing the `DanglingUntriaged` raw pointer to `content::WebContents` with a `base::WeakPtr`. Because `WebContents` can be destroyed before the `ReadingListPageHandler` (e.g., during teardown), accessing the dangling raw pointer could lead to Use-After-Free (UAF) bugs . Null checks have been added to safely return early in cases where `web_contents_` has already been invalidated. Bug: 490505884 Change-Id: I411121440d26ee770a775eda6d564ea56a385dbf Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7775987 Reviewed-by: Eshwar Stalin Commit-Queue: Foromo Daniel Soromou Cr-Commit-Position: refs/heads/main@{#1618202} --- .../reading_list/brave_reading_list_page_handler.cc | 4 +--- .../side_panel/reading_list/brave_reading_list_page_handler.h | 4 +--- 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/browser/ui/webui/side_panel/reading_list/brave_reading_list_page_handler.cc b/browser/ui/webui/side_panel/reading_list/brave_reading_list_page_handler.cc index 27c2386b724..3c2b0564df6 100644 --- a/browser/ui/webui/side_panel/reading_list/brave_reading_list_page_handler.cc +++ b/browser/ui/webui/side_panel/reading_list/brave_reading_list_page_handler.cc @@ -17,8 +17,7 @@ BraveReadingListPageHandler::BraveReadingListPageHandler( : ReadingListPageHandler(std::move(receiver), std::move(page), reading_list_ui, - web_ui), - WebContentsObserver(web_ui->GetWebContents()) {} + web_ui) {} BraveReadingListPageHandler::~BraveReadingListPageHandler() = default; @@ -33,7 +32,6 @@ void BraveReadingListPageHandler::OnVisibilityChanged( // should be called once when web contents is visible after panel is opened. // After that, upstream code will update properly for relavant events such // as tab change and etc. - Observe(nullptr); UpdateCurrentPageActionButton(); } } diff --git a/browser/ui/webui/side_panel/reading_list/brave_reading_list_page_handler.h b/browser/ui/webui/side_panel/reading_list/brave_reading_list_page_handler.h index 1a368cf6e4a..5c6bb5d8b4e 100644 --- a/browser/ui/webui/side_panel/reading_list/brave_reading_list_page_handler.h +++ b/browser/ui/webui/side_panel/reading_list/brave_reading_list_page_handler.h @@ -9,14 +9,12 @@ #include "chrome/browser/ui/webui/side_panel/reading_list/reading_list.mojom.h" #include "chrome/browser/ui/webui/side_panel/reading_list/reading_list_page_handler.h" #include "content/public/browser/visibility.h" -#include "content/public/browser/web_contents_observer.h" #include "mojo/public/cpp/bindings/pending_receiver.h" #include "mojo/public/cpp/bindings/pending_remote.h" class ReadingListUI; -class BraveReadingListPageHandler : public ReadingListPageHandler, - public content::WebContentsObserver { +class BraveReadingListPageHandler : public ReadingListPageHandler { public: BraveReadingListPageHandler( mojo::PendingReceiver receiver,