Fix uaf in ApplicationInstance.

mojo/shell/application_manager.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/shell/application_manager.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/macros.h"
@@ skipping 167 matching lines @@
 bool ApplicationManager::ConnectToRunningApplication(
     ApplicationInstance* originator,
     const GURL& resolved_url,
     const std::string& qualifier,
     const GURL& requestor_url,
     InterfaceRequest<ServiceProvider>* services,
     ServiceProviderPtr* exposed_services,
     CapabilityFilterPtr* filter) {
   GURL application_url = GetBaseURLAndQuery(resolved_url, nullptr);
   ApplicationInstance* instance =
-      GetApplicationInstance(application_url, qualifier);
+      GetApplicationInstance(Identity(application_url, qualifier));
   if (!instance)
     return false;
 
   instance->ConnectToClient(originator, resolved_url, requestor_url,
                             services->Pass(), exposed_services->Pass(),
                             filter->Pass());
   return true;
 }
 
 bool ApplicationManager::ConnectToApplicationWithLoader(
@@ skipping 36 matching lines @@
   InterfaceRequest<Application> application_request = GetProxy(&application);
   ApplicationInstance::CapabilityFilter capability_filter;
   std::set<std::string> interfaces;
   interfaces.insert("*");
   capability_filter["*"] = interfaces;
   if (!filter.is_null()) {
     capability_filter =
         filter->filter.To<ApplicationInstance::CapabilityFilter>();
   }
   ApplicationInstance* instance = new ApplicationInstance(
-      application.Pass(), this, app_identity, capability_filter,
-      on_application_end);
+      application.Pass(), this,
+      originator ? originator->identity() : Identity(GURL()), app_identity,
+      capability_filter, on_application_end);
   identity_to_instance_[app_identity] = instance;
   instance->InitializeApplication();
   instance->ConnectToClient(originator, app_url, requestor_url, services.Pass(),
                             exposed_services.Pass(), filter.Pass());
   return application_request.Pass();
 }
 
 ApplicationInstance* ApplicationManager::GetApplicationInstance(
-    const GURL& url,
-    const std::string& qualifier) {
-  const auto& instance_it =
-      identity_to_instance_.find(Identity(url, qualifier));
+    const Identity& identity) const {
+  const auto& instance_it = identity_to_instance_.find(identity);
   if (instance_it != identity_to_instance_.end())
     return instance_it->second;
   return nullptr;
 }
 
 void ApplicationManager::HandleFetchCallback(
     ApplicationInstance* originator,
     const GURL& requested_url,
     const std::string& qualifier,
     const GURL& requestor_url,
@@ skipping 264 matching lines @@
   request->url = mojo::String::From(application_url.spec());
   ConnectToApplication(nullptr, request.Pass(), std::string(), GURL(),
                        GetProxy(&services), nullptr, nullptr, base::Closure());
   MessagePipe pipe;
   services->ConnectToService(interface_name, pipe.handle1.Pass());
   return pipe.handle0.Pass();
 }
 
 }  // namespace shell
 }  // namespace mojo