Fix use-after-free in WebstoreInstaller

chrome/browser/extensions/webstore_installer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/webstore_installer.h"
 
 #include <vector>
 
 #include "base/basictypes.h"
 #include "base/bind.h"
@@ skipping 226 matching lines @@
 
 WebstoreInstaller::Approval::~Approval() {}
 
 const WebstoreInstaller::Approval* WebstoreInstaller::GetAssociatedApproval(
     const DownloadItem& download) {
   return static_cast<const Approval*>(download.GetUserData(kApprovalKey));
 }
 
 WebstoreInstaller::WebstoreInstaller(Profile* profile,
                                      Delegate* delegate,
-                                     NavigationController* controller,
+                                     content::WebContents* web_contents,
                                      const std::string& id,
                                      scoped_ptr<Approval> approval,
                                      InstallSource source)
-    : profile_(profile),
+    : content::WebContentsObserver(web_contents),
+      profile_(profile),
       delegate_(delegate),
-      controller_(controller),
       id_(id),
       install_source_(source),
       download_item_(NULL),
       approval_(approval.release()),
       total_modules_(0),
       download_started_(false) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
-  DCHECK(controller_);
+  DCHECK(web_contents);
 
   registrar_.Add(this, chrome::NOTIFICATION_CRX_INSTALLER_DONE,
                  content::NotificationService::AllSources());
   registrar_.Add(this, chrome::NOTIFICATION_EXTENSION_INSTALLED,
                  content::Source<Profile>(profile->GetOriginalProfile()));
   registrar_.Add(this, chrome::NOTIFICATION_EXTENSION_INSTALL_ERROR,
                  content::Source<CrxInstaller>(NULL));
 }
 
 void WebstoreInstaller::Start() {
@@ skipping 127 matching lines @@
 void WebstoreInstaller::InvalidateDelegate() {
   delegate_ = NULL;
 }
 
 void WebstoreInstaller::SetDownloadDirectoryForTests(
     base::FilePath* directory) {
   g_download_directory_for_tests = directory;
 }
 
 WebstoreInstaller::~WebstoreInstaller() {
-  controller_ = NULL;
   if (download_item_) {
     download_item_->RemoveObserver(this);
     download_item_ = NULL;
   }
 }
 
 void WebstoreInstaller::OnDownloadStarted(
     DownloadItem* item,
     content::DownloadInterruptReason interrupt_reason) {
   if (!item) {
@@ skipping 131 matching lines @@
 // http://crbug.com/126013
 // The current working theory is that one of the many pointers dereferenced in
 // here is occasionally deleted before all of its referers are nullified,
 // probably in a callback race. After this comment is released, the crash
 // reports should narrow down exactly which pointer it is.  Collapsing all the
 // early-returns into a single branch makes it hard to see exactly which pointer
 // it is.
 void WebstoreInstaller::StartDownload(const base::FilePath& file) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 
-  DownloadManager* download_manager =
-    BrowserContext::GetDownloadManager(profile_);
   if (file.empty()) {
     ReportFailure(kDownloadDirectoryError, FAILURE_REASON_OTHER);
     return;
   }
+
+  DownloadManager* download_manager =
+      BrowserContext::GetDownloadManager(profile_);
   if (!download_manager) {
     ReportFailure(kDownloadDirectoryError, FAILURE_REASON_OTHER);
     return;
   }
-  if (!controller_) {
+
+  content::WebContents* contents = web_contents();
+  if (!contents) {
     ReportFailure(kDownloadDirectoryError, FAILURE_REASON_OTHER);
     return;
   }
-  if (!controller_->GetWebContents()) {
+  if (!contents->GetRenderProcessHost()) {
     ReportFailure(kDownloadDirectoryError, FAILURE_REASON_OTHER);
     return;
   }
-  if (!controller_->GetWebContents()->GetRenderProcessHost()) {
+  if (!contents->GetRenderViewHost()) {
     ReportFailure(kDownloadDirectoryError, FAILURE_REASON_OTHER);
     return;
   }
-  if (!controller_->GetWebContents()->GetRenderViewHost()) {
+
+  content::NavigationController& controller = contents->GetController();
+  if (!controller.GetBrowserContext()) {
     ReportFailure(kDownloadDirectoryError, FAILURE_REASON_OTHER);
     return;
   }
-  if (!controller_->GetBrowserContext()) {
+  if (!controller.GetBrowserContext()->GetResourceContext()) {
     ReportFailure(kDownloadDirectoryError, FAILURE_REASON_OTHER);
     return;
   }
-  if (!controller_->GetBrowserContext()->GetResourceContext()) {
-    ReportFailure(kDownloadDirectoryError, FAILURE_REASON_OTHER);
-    return;
-  }
 
   // The download url for the given extension is contained in |download_url_|.
   // We will navigate the current tab to this url to start the download. The
   // download system will then pass the crx to the CrxInstaller.
   RecordDownloadSource(DOWNLOAD_INITIATED_BY_WEBSTORE_INSTALLER);
-  int render_process_host_id =
-    controller_->GetWebContents()->GetRenderProcessHost()->GetID();
+  int render_process_host_id = contents->GetRenderProcessHost()->GetID();
   int render_view_host_routing_id =
-    controller_->GetWebContents()->GetRenderViewHost()->GetRoutingID();
+      contents->GetRenderViewHost()->GetRoutingID();
   content::ResourceContext* resource_context =
-    controller_->GetBrowserContext()->GetResourceContext();
+      controller.GetBrowserContext()->GetResourceContext();
   scoped_ptr<DownloadUrlParameters> params(new DownloadUrlParameters(
       download_url_,
       render_process_host_id,
       render_view_host_routing_id ,
       resource_context));
   params->set_file_path(file);
-  if (controller_->GetVisibleEntry())
+  if (controller.GetVisibleEntry())
     params->set_referrer(
-        content::Referrer(controller_->GetVisibleEntry()->GetURL(),
+        content::Referrer(controller.GetVisibleEntry()->GetURL(),
                           blink::WebReferrerPolicyDefault));
   params->set_callback(base::Bind(&WebstoreInstaller::OnDownloadStarted, this));
   download_manager->DownloadUrl(params.Pass());
 }
 
 void WebstoreInstaller::ReportFailure(const std::string& error,
                                       FailureReason reason) {
   if (delegate_) {
     delegate_->OnExtensionInstallFailure(id_, error, reason);
     delegate_ = NULL;
@@ skipping 36 matching lines @@
         1,
         kMaxSizeKb,
         kNumBuckets);
   }
   UMA_HISTOGRAM_BOOLEAN(
       "Extensions.WebstoreDownload.InterruptTotalSizeUnknown",
       total_bytes <= 0);
 }
 
 }  // namespace extensions