Fix UAF in Origin Info Bubble and permission settings UI.

chrome/browser/ui/cocoa/website_settings/website_settings_bubble_controller.mm

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "chrome/browser/ui/cocoa/website_settings/website_settings_bubble_controller.h"
 
 #include <cmath>
 
 #import <AppKit/AppKit.h>
 
@@ skipping 1153 matching lines @@
 }
 
 - (void)setSelectedTab:(WebsiteSettingsUI::TabId)tabId {
   NSInteger index = static_cast<NSInteger>(tabId);
   [segmentedControl_ setSelectedSegment:index];
   [tabView_ selectTabViewItemAtIndex:index];
 }
 
 @end
 
-WebsiteSettingsUIBridge::WebsiteSettingsUIBridge()
-  : bubble_controller_(nil) {
-}
+WebsiteSettingsUIBridge::WebsiteSettingsUIBridge(
+    content::WebContents* web_contents)
+    : content::WebContentsObserver(web_contents),
+      web_contents_(web_contents),
+      bubble_controller_(nil) {}
 
 WebsiteSettingsUIBridge::~WebsiteSettingsUIBridge() {
 }
 
 void WebsiteSettingsUIBridge::set_bubble_controller(
     WebsiteSettingsBubbleController* controller) {
   bubble_controller_ = controller;
 }
 
 void WebsiteSettingsUIBridge::Show(gfx::NativeWindow parent,
                                    Profile* profile,
                                    content::WebContents* web_contents,
                                    const GURL& url,
                                    const content::SSLStatus& ssl) {
   if (chrome::ToolkitViewsDialogsEnabled()) {
     chrome::ShowWebsiteSettingsBubbleViewsAtPoint(
         gfx::ScreenPointFromNSPoint(AnchorPointForWindow(parent)), profile,
         web_contents, url, ssl);
     return;
   }
 
   bool is_internal_page = InternalChromePage(url);
 
   // Create the bridge. This will be owned by the bubble controller.
-  WebsiteSettingsUIBridge* bridge = new WebsiteSettingsUIBridge();
+  WebsiteSettingsUIBridge* bridge = new WebsiteSettingsUIBridge(web_contents);
 
   // Create the bubble controller. It will dealloc itself when it closes.
   WebsiteSettingsBubbleController* bubble_controller =
       [[WebsiteSettingsBubbleController alloc]
           initWithParentWindow:parent
        websiteSettingsUIBridge:bridge
                    webContents:web_contents
                 isInternalPage:is_internal_page];
 
   if (!is_internal_page) {
     // Initialize the presenter, which holds the model and controls the UI.
     // This is also owned by the bubble controller.
     WebsiteSettings* presenter = new WebsiteSettings(
-        bridge,
-        profile,
-        TabSpecificContentSettings::FromWebContents(web_contents),
-        InfoBarService::FromWebContents(web_contents),
-        url,
-        ssl,
-        content::CertStore::GetInstance());
+        bridge, profile,
+        TabSpecificContentSettings::FromWebContents(web_contents), web_contents,
+        url, ssl, content::CertStore::GetInstance());
     [bubble_controller setPresenter:presenter];
   }
 
   [bubble_controller showWindow:nil];
 }
 
 void WebsiteSettingsUIBridge::SetIdentityInfo(
     const WebsiteSettingsUI::IdentityInfo& identity_info) {
   [bubble_controller_ setIdentityInfo:identity_info];
 }
 
+void WebsiteSettingsUIBridge::RenderFrameDeleted(
+    content::RenderFrameHost* render_frame_host) {
+  if (render_frame_host == web_contents_->GetMainFrame()) {
+    [bubble_controller_ close];
+  }
+}
+
 void WebsiteSettingsUIBridge::SetCookieInfo(
     const CookieInfoList& cookie_info_list) {
   [bubble_controller_ setCookieInfo:cookie_info_list];
 }
 
 void WebsiteSettingsUIBridge::SetPermissionInfo(
     const PermissionInfoList& permission_info_list) {
   [bubble_controller_ setPermissionInfo:permission_info_list];
 }
 
 void WebsiteSettingsUIBridge::SetSelectedTab(TabId tab_id) {
   [bubble_controller_ setSelectedTab:tab_id];
 }