Fix use-after-free in WebstoreInstaller

chrome/browser/extensions/webstore_installer.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_EXTENSIONS_WEBSTORE_INSTALLER_H_
 #define CHROME_BROWSER_EXTENSIONS_WEBSTORE_INSTALLER_H_
 
 #include <list>
 #include <string>
 
 #include "base/compiler_specific.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/supports_user_data.h"
 #include "base/values.h"
 #include "base/version.h"
 #include "chrome/browser/extensions/extension_install_prompt.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/download_interrupt_reasons.h"
 #include "content/public/browser/download_item.h"
 #include "content/public/browser/notification_observer.h"
 #include "content/public/browser/notification_registrar.h"
+#include "content/public/browser/web_contents_observer.h"
 #include "extensions/common/manifest_handlers/shared_module_info.h"
 #include "ui/gfx/image/image_skia.h"
 #include "url/gurl.h"
 
 class Profile;
 
 namespace base {
 class FilePath;
 }
 
 namespace content {
-class NavigationController;
+class WebContents;
 }
 
 namespace extensions {
 
 class Extension;
 class Manifest;
 
 // Downloads and installs extensions from the web store.
-class WebstoreInstaller :public content::NotificationObserver,
-                         public content::DownloadItem::Observer,
-                         public base::RefCountedThreadSafe<
+class WebstoreInstaller : public content::NotificationObserver,
+                          public content::DownloadItem::Observer,
+                          public content::WebContentsObserver,
+                          public base::RefCountedThreadSafe<
   WebstoreInstaller, content::BrowserThread::DeleteOnUIThread> {
  public:
   enum InstallSource {
     // Inline installs trigger slightly different behavior (install source
     // is different, download referrers are the item's page in the gallery).
     INSTALL_SOURCE_INLINE,
     INSTALL_SOURCE_APP_LAUNCHER,
     INSTALL_SOURCE_OTHER
   };
 
@@ skipping 109 matching lines @@
 
   // Creates a WebstoreInstaller for downloading and installing the extension
   // with the given |id| from the Chrome Web Store. If |delegate| is not NULL,
   // it will be notified when the install succeeds or fails. The installer will
   // use the specified |controller| to download the extension. Only one
   // WebstoreInstaller can use a specific controller at any given time. This
   // also associates the |approval| with this install.
   // Note: the delegate should stay alive until being called back.
   WebstoreInstaller(Profile* profile,
                     Delegate* delegate,
-                    content::NavigationController* controller,
+                    content::WebContents* web_contents,
                     const std::string& id,
                     scoped_ptr<Approval> approval,
                     InstallSource source);
 
   // Starts downloading and installing the extension.
   void Start();
 
   // content::NotificationObserver
   virtual void Observe(int type,
                        const content::NotificationSource& source,
@@ skipping 44 matching lines @@
   // this managed its installation. This also removes the associated
   // PendingInstall.
   void ReportSuccess();
 
   // Records stats regarding an interrupted webstore download item.
   void RecordInterrupt(const content::DownloadItem* download) const;
 
   content::NotificationRegistrar registrar_;
   Profile* profile_;
   Delegate* delegate_;
-  content::NavigationController* controller_;
   std::string id_;
   InstallSource install_source_;
   // The DownloadItem is owned by the DownloadManager and is valid from when
   // OnDownloadStarted is called (with no error) until OnDownloadDestroyed().
   content::DownloadItem* download_item_;
   scoped_ptr<Approval> approval_;
   GURL download_url_;
 
   // Pending modules.
   std::list<SharedModuleInfo::ImportInfo> pending_modules_;
   // Total extension modules we need download and install (the main module and
   // depedences).
   int total_modules_;
   bool download_started_;
 };
 
 }  // namespace extensions
 
 #endif  // CHROME_BROWSER_EXTENSIONS_WEBSTORE_INSTALLER_H_