Fix use after free in JavascriptAppModalDialogAndroid.

chrome/android/java/src/org/chromium/chrome/browser/JavascriptAppModalDialog.java

Index: chrome/android/java/src/org/chromium/chrome/browser/JavascriptAppModalDialog.java
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/JavascriptAppModalDialog.java b/chrome/android/java/src/org/chromium/chrome/browser/JavascriptAppModalDialog.java
index a400543db0997cd3c0c4742048fefe89710f3969..7d064abd4e30069d9c1f54572d479905e9f923bb 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/JavascriptAppModalDialog.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/JavascriptAppModalDialog.java
@@ -122,6 +122,7 @@ public class JavascriptAppModalDialog implements DialogInterface.OnClickListener
     @CalledByNative
     void dismiss() {
         mDialog.dismiss();
+        mNativeDialogPointer = 0;
     }
 
     /**
@@ -175,11 +176,15 @@ public class JavascriptAppModalDialog implements DialogInterface.OnClickListener
     }
 
     public void confirm(String promptResult, boolean suppressDialogs) {
-        nativeDidAcceptAppModalDialog(mNativeDialogPointer, promptResult, suppressDialogs);
+        if (mNativeDialogPointer != 0) {
+            nativeDidAcceptAppModalDialog(mNativeDialogPointer, promptResult, suppressDialogs);
+        }
     }
 
     public void cancel(boolean suppressDialogs) {
-        nativeDidCancelAppModalDialog(mNativeDialogPointer, suppressDialogs);
+        if (mNativeDialogPointer != 0) {
+            nativeDidCancelAppModalDialog(mNativeDialogPointer, suppressDialogs);
+        }
     }
 
     private static class JavascriptAppAlertDialog extends JavascriptAppModalDialog {