Fix use-after-free in WebstoreInstaller

chrome/browser/extensions/bundle_installer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/bundle_installer.h"
 
 #include <algorithm>
 #include <string>
 #include <vector>
 
 #include "base/command_line.h"
 #include "base/i18n/rtl.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/values.h"
 #include "chrome/browser/extensions/crx_installer.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_finder.h"
 #include "chrome/browser/ui/browser_list.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/common/chrome_switches.h"
-#include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/web_contents.h"
 #include "extensions/common/extension.h"
 #include "extensions/common/permissions/permission_set.h"
 #include "extensions/common/permissions/permissions_data.h"
 #include "grit/generated_resources.h"
 #include "ui/base/l10n/l10n_util.h"
 
-using content::NavigationController;
-
 namespace extensions {
 
 namespace {
 
 enum AutoApproveForTest {
   DO_NOT_SKIP = 0,
   PROCEED,
   ABORT
 };
 
@@ skipping 87 matching lines @@
 }
 
 void BundleInstaller::PromptForApproval(Delegate* delegate) {
   delegate_ = delegate;
 
   AddRef();  // Balanced in ReportApproved() and ReportCanceled().
 
   ParseManifests();
 }
 
-void BundleInstaller::CompleteInstall(NavigationController* controller,
+void BundleInstaller::CompleteInstall(content::WebContents* web_contents,
                                       Delegate* delegate) {
   CHECK(approved_);
 
   delegate_ = delegate;
 
   AddRef();  // Balanced in ReportComplete();
 
   if (GetItemsWithState(Item::STATE_PENDING).empty()) {
     ReportComplete();
     return;
@@ skipping 11 matching lines @@
             profile_,
             i->first,
             scoped_ptr<base::DictionaryValue>(
                 parsed_manifests_[i->first]->DeepCopy()), true));
     approval->use_app_installed_bubble = false;
     approval->skip_post_install_ui = true;
 
     scoped_refptr<WebstoreInstaller> installer = new WebstoreInstaller(
         profile_,
         this,
-        controller,
+        web_contents,
         i->first,
         approval.Pass(),
         WebstoreInstaller::INSTALL_SOURCE_OTHER);
     installer->Start();
   }
 }
 
 base::string16 BundleInstaller::GetHeadingTextFor(Item::State state) const {
   // For STATE_FAILED, we can't tell if the items were apps or extensions
   // so we always show the same message.
@@ skipping 166 matching lines @@
 void BundleInstaller::OnBrowserAdded(Browser* browser) {}
 
 void BundleInstaller::OnBrowserRemoved(Browser* browser) {
   if (browser_ == browser)
     browser_ = NULL;
 }
 
 void BundleInstaller::OnBrowserSetLastActive(Browser* browser) {}
 
 }  // namespace extensions