Commit message: None
CVE: CVE-2012-2842
CWE: CWE-399
Vulnerability description: Use-after-free vulnerability in Google Chrome before 20.0.1132.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to counter handling.

Project: Chrome

views::View* TrayPower::CreateDefaultView(user::LoginStatus status) {
  date_.reset(new tray::DateView(tray::DateView::DATE));
  if (status != user::LOGGED_IN_NONE && status != user::LOGGED_IN_LOCKED)
    date_->set_actionable(true);

  views::View* container = new views::View;
  views::BoxLayout* layout = new views::BoxLayout(views::BoxLayout::kHorizontal,
      kTrayPopupPaddingHorizontal, 10, 0);
  layout->set_spread_blank_space(true);
  container->SetLayoutManager(layout);
  container->set_background(views::Background::CreateSolidBackground(
      SkColorSetRGB(0xf1, 0xf1, 0xf1)));
  container->AddChildView(date_.get());

  PowerSupplyStatus power_status =
      ash::Shell::GetInstance()->tray_delegate()->GetPowerSupplyStatus();
  if (power_status.battery_is_present) {
    power_.reset(new tray::PowerPopupView());
    power_->UpdatePowerStatus(power_status);
    container->AddChildView(power_.get());
  }
  return container;
}

Project: Chrome

views::View* TrayPower::CreateDetailedView(user::LoginStatus status) {
  return NULL;
}

Project: Chrome

views::View* TrayPower::CreateTrayView(user::LoginStatus status) {
  PowerSupplyStatus power_status =
      ash::Shell::GetInstance()->tray_delegate()->GetPowerSupplyStatus();
  power_tray_.reset(new tray::PowerTrayView());
  power_tray_->UpdatePowerStatus(power_status);
  return power_tray_.get();
}

Project: Chrome

void TrayPower::DestroyDefaultView() {
  date_.reset();
  power_.reset();
}

Project: Chrome

void TrayPower::DestroyDetailedView() {
}

Project: Chrome

void TrayPower::DestroyTrayView() {
  power_tray_.reset();
}

Project: Chrome

void TrayPower::OnPowerStatusChanged(const PowerSupplyStatus& status) {
  if (power_tray_.get())
    power_tray_->UpdatePowerStatus(status);
  if (power_.get())
    power_->UpdatePowerStatus(status);
}

Project: Chrome

  PowerTrayView() {
    UpdateImage();
  }

Project: Chrome

TrayPower::TrayPower()
    : power_(NULL),
      power_tray_(NULL) {
}

Project: Chrome

  void UpdateImage() {
    SkBitmap image;
    gfx::Image all = ui::ResourceBundle::GetSharedInstance().GetImageNamed(
        IDR_AURA_UBER_TRAY_POWER_SMALL);

    int image_index = 0;
    if (supply_status_.battery_percentage >= 100) {
      image_index = kNumPowerImages - 1;
    } else if (!supply_status_.battery_is_present) {
      image_index = kNumPowerImages;
    } else {
      image_index = static_cast<int> (
          supply_status_.battery_percentage / 100.0 *
          (kNumPowerImages - 1));
      image_index =
        std::max(std::min(image_index, kNumPowerImages - 2), 0);
    }

    SkIRect region = SkIRect::MakeXYWH(
        (supply_status_.line_power_on ? kBatteryImageWidth : 0) + 2,
        image_index * kBatteryImageHeight,
        kBatteryImageWidth - 2, kBatteryImageHeight);
    all.ToSkBitmap()->extractSubset(&image, region);

    SetImage(image);
  }

Project: Chrome

  void UpdatePowerStatus(const PowerSupplyStatus& status) {
    supply_status_ = status;
    if (supply_status_.battery_is_full)
      supply_status_.battery_percentage = 100.0;

    UpdateText();
  }

Project: Chrome

  void UpdateText() {
    base::TimeDelta time = base::TimeDelta::FromSeconds(
        supply_status_.line_power_on ?
        supply_status_.battery_seconds_to_full :
        supply_status_.battery_seconds_to_empty);
    int hour = time.InHours();
    int min = (time - base::TimeDelta::FromHours(hour)).InMinutes();
    ui::ResourceBundle& bundle = ui::ResourceBundle::GetSharedInstance();
    if (hour || min) {
      SetText(l10n_util::GetStringFUTF16(IDS_ASH_STATUS_TRAY_BATTERY_STATUS,
          base::IntToString16(
              static_cast<int>(supply_status_.battery_percentage)),
          base::IntToString16(hour),
          base::IntToString16(min)));
    } else {
      if (supply_status_.line_power_on) {
        SetText(bundle.GetLocalizedString(IDS_ASH_STATUS_TRAY_BATTERY_FULL));
      } else {
        SetText(string16());
      }
    }
  }

Project: Chrome

  virtual ~PowerPopupView() {
  }

Project: Chrome

TrayPower::~TrayPower() {
}