Code: void BrowserContextDestroyer::DestroyContext(BrowserContext* context) {
  CHECK(context->IsOffTheRecord() || !context->HasOffTheRecordContext());
 
  content::BrowserContext::NotifyWillBeDestroyed(context);
  std::set<content::RenderProcessHost*> hosts;
 
  for (content::RenderProcessHost::iterator it =
           content::RenderProcessHost::AllHostsIterator();
       !it.IsAtEnd(); it.Advance()) {
    content::RenderProcessHost* host = it.GetCurrentValue();
    if (host->GetBrowserContext() != context) {
      continue;
     }
 
    hosts.insert(host);
//// static
   }
 
 
  if (hosts.empty()) {
    delete context;
  } else {
    new BrowserContextDestroyer(context, hosts);
   }
 }

Vulnerability Type: 
CWE ID: CWE-20
Summary: A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for destruction in versions of Oxide before 1.18.3.
Commit Message: 