Code: OmniboxPopupViewGtk::OmniboxPopupViewGtk(const gfx::Font& font,
                                          OmniboxView* omnibox_view,
                                          AutocompleteEditModel* edit_model,
                                          GtkWidget* location_bar)
    : model_(new AutocompletePopupModel(this, edit_model)),
       omnibox_view_(omnibox_view),
       location_bar_(location_bar),
       window_(gtk_window_new(GTK_WINDOW_POPUP)),
      layout_(NULL),
      theme_service_(ThemeServiceGtk::GetFrom(edit_model->profile())),
      font_(font.DeriveFont(kEditFontAdjust)),
      ignore_mouse_drag_(false),
      opened_(false) {
  gtk_widget_set_can_focus(window_, FALSE);
  gtk_window_set_resizable(GTK_WINDOW(window_), FALSE);
  gtk_widget_set_app_paintable(window_, TRUE);
  gtk_widget_set_double_buffered(window_, TRUE);

  layout_ = gtk_widget_create_pango_layout(window_, NULL);
  pango_layout_set_auto_dir(layout_, FALSE);
  pango_layout_set_ellipsize(layout_, PANGO_ELLIPSIZE_END);

  gtk_widget_add_events(window_, GDK_BUTTON_MOTION_MASK |
                                  GDK_POINTER_MOTION_MASK |
                                  GDK_BUTTON_PRESS_MASK |
                                  GDK_BUTTON_RELEASE_MASK);
  g_signal_connect(window_, "motion-notify-event",
                   G_CALLBACK(HandleMotionThunk), this);
  g_signal_connect(window_, "button-press-event",
                   G_CALLBACK(HandleButtonPressThunk), this);
  g_signal_connect(window_, "button-release-event",
                   G_CALLBACK(HandleButtonReleaseThunk), this);
  g_signal_connect(window_, "expose-event",
                   G_CALLBACK(HandleExposeThunk), this);
 
   registrar_.Add(this,
                  chrome::NOTIFICATION_BROWSER_THEME_CHANGED,
                 content::Source<ThemeService>(theme_service_));
  theme_service_->InitThemesFor(this);

 }

Vulnerability Type: DoS 
CWE ID: CWE-399
Summary: Use-after-free vulnerability in Google Chrome before 19.0.1084.46 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging an error in the GTK implementation of the omnibox.
Commit Message: GTK: Stop listening to gtk signals in the omnibox before destroying the model.

BUG=123530
TEST=none


Review URL: http://codereview.chromium.org/10103012

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@132498 0039d316-1c4b-4281-b951-d872f2087c98