Fix use-after-free in WebstoreInstaller

chrome/browser/extensions/bundle_installer.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_EXTENSIONS_BUNDLE_INSTALLER_H_
 #define CHROME_BROWSER_EXTENSIONS_BUNDLE_INSTALLER_H_
 
 #include <string>
 #include <vector>
 
 #include "base/memory/linked_ptr.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/strings/string16.h"
 #include "chrome/browser/extensions/extension_install_prompt.h"
 #include "chrome/browser/extensions/webstore_install_helper.h"
 #include "chrome/browser/extensions/webstore_installer.h"
 #include "chrome/browser/ui/browser_list_observer.h"
 #include "chrome/browser/ui/host_desktop.h"
 #include "extensions/common/extension.h"
 
 namespace base {
 class DictionaryValue;
 }  // namespace base
 
 namespace content {
-class NavigationController;
+class WebContents;
 }  // namespace content
 
 class Browser;
 class Profile;
 
 namespace extensions {
 
 // Manages the installation life cycle for extension bundles.
 //
 // We install bundles in two steps:
@@ skipping 52 matching lines @@
 
   // Parses the extension manifests and then prompts the user to approve their
   // permissions. One of OnBundleInstallApproved or OnBundleInstallCanceled
   // will be called when complete if |delegate| is not NULL.
   // Note: the |delegate| must stay alive until receiving the callback.
   void PromptForApproval(Delegate* delegate);
 
   // If the bundle has been approved, this downloads and installs the member
   // extensions. OnBundleInstallComplete will be called when the process is
   // complete and |delegate| is not NULL. The download process uses the
-  // specified |controller|. When complete, we show a confirmation bubble in
-  // the specified |browser|.
+  // NavigationController of the specified |web_contents|. When complete, we
+  // show a confirmation bubble in the specified |browser|.
   // Note: the |delegate| must stay alive until receiving the callback.
-  void CompleteInstall(content::NavigationController* controller,
-                       Delegate* delegate);
+  void CompleteInstall(content::WebContents* web_contents, Delegate* delegate);
 
   // We change the headings in the install prompt and installed bubble depending
   // on whether the bundle contains apps, extensions or both. This method gets
   // the correct heading for the items in the specified |state|, or an empty
   // string if no items are in the |state|.
   //   STATE_PENDING   - install prompt
   //   STATE_INSTALLED - installed bubble successful installs list
   //   STATE_FAILED    - installed bubble failed installs list
   base::string16 GetHeadingTextFor(Item::State state) const;
 
@@ skipping 83 matching lines @@
   scoped_ptr<ExtensionInstallPrompt> install_ui_;
 
   Delegate* delegate_;
 
   DISALLOW_COPY_AND_ASSIGN(BundleInstaller);
 };
 
 }  // namespace extensions
 
 #endif  // CHROME_BROWSER_EXTENSIONS_BUNDLE_INSTALLER_H_