a7ab43e
From c2d0133f47afb59b4ce64e42215d1d053f15250a Mon Sep 17 00:00:00 2001
a7ab43e
From: Stephan Hartmann <stha09@googlemail.com>
a7ab43e
Date: Tue, 13 Apr 2021 23:21:42 +0000
a7ab43e
Subject: [PATCH] fix crash in ThemeService
a7ab43e
a7ab43e
ThemeSyncableService and ThemeService are owned by each other. On
a7ab43e
destruction of ThemeService, ThemeSyncableService gets destructed as
a7ab43e
well, but calls RemoveObserver of partly destructed ThemeService object.
a7ab43e
To avoid already destructed |observers_| list, move it before
a7ab43e
|theme_syncable_service_| definition.
a7ab43e
a7ab43e
Bug: 1190561
a7ab43e
Change-Id: I4dc2c990d589071d97b7fa737afef54463c84751
a7ab43e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2821311
a7ab43e
Commit-Queue: Peter Kasting <pkasting@chromium.org>
a7ab43e
Reviewed-by: Peter Kasting <pkasting@chromium.org>
a7ab43e
Cr-Commit-Position: refs/heads/master@{#872164}
a7ab43e
---
a7ab43e
 chrome/browser/themes/theme_service.h | 6 ++++--
a7ab43e
 1 file changed, 4 insertions(+), 2 deletions(-)
a7ab43e
a7ab43e
diff --git a/chrome/browser/themes/theme_service.h b/chrome/browser/themes/theme_service.h
a7ab43e
index 592d40ae9de0f..337dfac9a040f 100644
a7ab43e
--- a/chrome/browser/themes/theme_service.h
a7ab43e
+++ b/chrome/browser/themes/theme_service.h
a7ab43e
@@ -299,6 +299,10 @@ class ThemeService : public KeyedService,
a7ab43e
   // The number of infobars currently displayed.
a7ab43e
   int number_of_reinstallers_ = 0;
a7ab43e
 
a7ab43e
+  // Declared before |theme_syncable_service_|, because ThemeSyncableService
a7ab43e
+  // removes itself from the |observers_| list on destruction.
a7ab43e
+  base::ObserverList<ThemeServiceObserver> observers_;
a7ab43e
+
a7ab43e
   std::unique_ptr<ThemeSyncableService> theme_syncable_service_;
a7ab43e
 
a7ab43e
 #if BUILDFLAG(ENABLE_EXTENSIONS)
a7ab43e
@@ -320,8 +324,6 @@ class ThemeService : public KeyedService,
a7ab43e
   ScopedObserver<ui::NativeTheme, ui::NativeThemeObserver>
a7ab43e
       native_theme_observer_{this};
a7ab43e
 
a7ab43e
-  base::ObserverList<ThemeServiceObserver> observers_;
a7ab43e
-
a7ab43e
   base::WeakPtrFactory<ThemeService> weak_ptr_factory_{this};
a7ab43e
 
a7ab43e
   DISALLOW_COPY_AND_ASSIGN(ThemeService);