Fix uaf in ApplicationInstance.

mojo/shell/application_instance.cc

Index: mojo/shell/application_instance.cc
diff --git a/mojo/shell/application_instance.cc b/mojo/shell/application_instance.cc
index 78a3275924974aac6948faff4f03b6b7605950e6..759c6b3c3a553dca68ebd0946f7b615c879025e1 100644
--- a/mojo/shell/application_instance.cc
+++ b/mojo/shell/application_instance.cc
@@ -23,10 +23,12 @@ ApplicationInstance::QueuedClientRequest::~QueuedClientRequest() {
 ApplicationInstance::ApplicationInstance(
     ApplicationPtr application,
     ApplicationManager* manager,
+    const Identity& originator_identity,
     const Identity& identity,
     const CapabilityFilter& filter,
     const base::Closure& on_application_end)
     : manager_(manager),
+      originator_identity_(originator_identity),
       identity_(identity),
       filter_(filter),
       allow_any_application_(filter.size() == 1 && filter.count("*") == 1),
@@ -144,7 +146,9 @@ void ApplicationInstance::OnConnectionError() {
   for (auto request : queued_client_requests) {
     mojo::URLRequestPtr url(mojo::URLRequest::New());
     url->url = mojo::String::From(request->requested_url.spec());
-    manager->ConnectToApplication(this, url.Pass(), std::string(),
+    ApplicationInstance* originator =
+        manager->GetApplicationInstance(originator_identity_);

[Ben Goodger (Google), 2015/07/27 19:26:34]

note to my future self: I am concerned that in its current form identity is
insufficient here, as |originator| as returned may differ from the instance that
spawned this instance. e.g.:

Instance1 is created for application identity "A,B" with a specific capability
filter CF1.
Instance1 connects to Instance2.
..
Instance1 is destroyed.
Instance3 is created for application identity "A,B" with specific capability
filter CF2 <-- note the difference.
Instance2 experiences a connection error and this code is reached.  It asks the
application manager for the instance corresponding to "A,B" and gets Instance3,
which has a different set of allowed interfaces than long-gone Instance1. Oops.

Ultimately I think CF should be part of the application identity.

+    manager->ConnectToApplication(originator, url.Pass(), std::string(),
                                   request->requestor_url,
                                   request->services.Pass(),
                                   request->exposed_services.Pass(),