Prevent the destruction of WebContents in NavigationThrottle methods

content/public/browser/navigation_throttle.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_PUBLIC_BROWSER_NAVIGATION_THROTTLE_H_
 #define CONTENT_PUBLIC_BROWSER_NAVIGATION_THROTTLE_H_
 
 #include "content/common/content_export.h"
 
 namespace content {
 class NavigationHandle;
 
 // A NavigationThrottle tracks and allows interaction with a navigation on the
 // UI thread.
 class CONTENT_EXPORT NavigationThrottle {
  public:
   // This is returned to the NavigationHandle to allow the navigation to
   // proceed, or to cancel it.
   enum ThrottleCheckResult {
+    // The navigation can proceed.
     PROCEED,
+
+    // The navigation is deferred until NavigationHandle::Resume is
+    // called.
     DEFER,
+
+    // The navigation is cancelled and the requester of the resource acts
+    // like the request was never made.
     CANCEL_AND_IGNORE,
+
+    // The NavigationRequest was destroyed during the call to WillStartRequest
+    // or the call to WillRedirectRequest.
+    DESTROYED,
   };
 
   NavigationThrottle(NavigationHandle* navigation_handle);
   virtual ~NavigationThrottle();
 
   // Called when a network request is about to be made for this navigation.
+  // Note: unless they return DESTROYED, NavigationThrottles must ensure that
+  // the WebContents is not destroyed during the execution of this function.
+  // Failing to do so will result in security-critical
+  // use-after-free bugs.
   virtual ThrottleCheckResult WillStartRequest();
 
   // Called when a server redirect is received by the navigation.
+  // Note: unless they return DESTROYED, NavigationThrottles must ensure that
+  // the WebContents is not destroyed during the execution of this function.
+  // Failing to do so will result in security-critical
+  // use-after-free bugs.
   virtual ThrottleCheckResult WillRedirectRequest();
 
   // The NavigationHandle that is tracking the information related to this
   // navigation.
   NavigationHandle* navigation_handle() const { return navigation_handle_; }
 
  private:
   NavigationHandle* navigation_handle_;
 };
 
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_BROWSER_NAVIGATION_THROTTLE_H_