Fix uaf in ApplicationInstance.

mojo/shell/application_manager.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SHELL_APPLICATION_MANAGER_APPLICATION_MANAGER_H_
 #define SHELL_APPLICATION_MANAGER_APPLICATION_MANAGER_H_
 
 #include <map>
 
 #include "base/macros.h"
@@ skipping 135 matching lines @@
   // and have a chance to shutdown.
   void TerminateShellConnections();
 
   // Removes a ApplicationInstance when it encounters an error.
   void OnApplicationInstanceError(ApplicationInstance* instance);
 
   // Removes a ContentHandler when its connection is closed.
   void OnContentHandlerConnectionClosed(
       ContentHandlerConnection* content_handler);
 
+  ApplicationInstance* GetApplicationInstance(const Identity& identity) const;
+
  private:
   using ApplicationPackagedAlias = std::map<GURL, std::pair<GURL, std::string>>;
   using IdentityToApplicationInstanceMap =
       std::map<Identity, ApplicationInstance*>;
   using MimeTypeToURLMap = std::map<std::string, GURL>;
   using SchemeToLoaderMap = std::map<std::string, ApplicationLoader*>;
   using URLToContentHandlerMap =
       std::map<std::pair<GURL, std::string>, ContentHandlerConnection*>;
   using URLToLoaderMap = std::map<GURL, ApplicationLoader*>;
   using URLToNativeOptionsMap = std::map<GURL, NativeRunnerFactory::Options>;
@@ skipping 21 matching lines @@
   InterfaceRequest<Application> RegisterInstance(
       ApplicationInstance* originator,
       const GURL& app_url,
       const std::string& qualifier,
       const GURL& requestor_url,
       InterfaceRequest<ServiceProvider> services,
       ServiceProviderPtr exposed_services,
       CapabilityFilterPtr filter,
       const base::Closure& on_application_end);
 
-  ApplicationInstance* GetApplicationInstance(const GURL& url,
-                                              const std::string& qualifier);
-
   // Called once |fetcher| has found app. |requested_url| is the url of the
   // requested application before any mappings/resolution have been applied.
   void HandleFetchCallback(ApplicationInstance* originator,
                            const GURL& requested_url,
                            const std::string& qualifier,
                            const GURL& requestor_url,
                            InterfaceRequest<ServiceProvider> services,
                            ServiceProviderPtr exposed_services,
                            CapabilityFilterPtr filter,
                            const base::Closure& on_application_end,
@@ skipping 45 matching lines @@
   bool disable_cache_;
   base::WeakPtrFactory<ApplicationManager> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(ApplicationManager);
 };
 
 }  // namespace shell
 }  // namespace mojo
 
 #endif  // SHELL_APPLICATION_MANAGER_APPLICATION_MANAGER_H_