Allow dynamic updating of authentication policies

android_webview/browser/net/aw_url_request_context_getter.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef ANDROID_WEBVIEW_BROWSER_NET_AW_URL_REQUEST_CONTEXT_GETTER_H_
 #define ANDROID_WEBVIEW_BROWSER_NET_AW_URL_REQUEST_CONTEXT_GETTER_H_
 
 #include "base/basictypes.h"
 #include "base/compiler_specific.h"
 #include "base/files/file_path.h"
 #include "base/memory/scoped_ptr.h"
 #include "content/public/browser/content_browser_client.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "net/url_request/url_request_job_factory.h"
 
 class PrefService;
 
 namespace net {
 class CookieStore;
 class HostResolver;
 class HttpAuthHandlerFactory;
+class HttpAuthPreferences;
 class HttpUserAgentSettings;
 class NetLog;
 class ProxyConfigService;
 class URLRequestContext;
 class URLRequestJobFactory;
-class URLSecurityManager;
 }
 
 namespace android_webview {
 
 class AwNetworkDelegate;
 
 class AwURLRequestContextGetter : public net::URLRequestContextGetter {
  public:
   AwURLRequestContextGetter(
       const base::FilePath& cache_path,
@@ skipping 37 matching lines @@
 
   const base::FilePath cache_path_;
 
   scoped_ptr<net::NetLog> net_log_;
   scoped_ptr<net::ProxyConfigService> proxy_config_service_;
   scoped_refptr<net::CookieStore> cookie_store_;
   scoped_ptr<net::URLRequestJobFactory> job_factory_;
   scoped_ptr<net::HttpUserAgentSettings> http_user_agent_settings_;
   scoped_ptr<net::URLRequestContext> url_request_context_;
 
-  // URLSecurityManager associated with the negotiate auth handler. It is
-  // configured to follow the auth_server_whitelist_
-  scoped_ptr<net::URLSecurityManager> url_security_manager_;
+  // http_auth_preferences_ holds the preferences for the negotiate
+  // authenticator.
+  scoped_ptr<net::HttpAuthPreferences> http_auth_preferences_;

[asanka, 2015/12/01 05:30:03]

The scoped_ptr<net::URLRequestContext> in line 83 actually is-a
ContainerURLRequestContext that bundles a net::URLRequestContextStorage which
owns a net::HttpAuthHandlerRegistryFactory which holds a reference to the
HttpAuthPreferences object owned by http_auth_preferences_.

However the destruction order for the AwURLRequestContextGetter results in
freeing the owned http_auth_preferences_ object prior to destroying the
url_request_context_ object. By the time the url_request_context_ is destroyed,
its contained auth handler factory references freed memory.

Could you move the http_auth_preferences_ definition above url_request_context_
so that the destruction order is safe?

[aberent, 2015/12/01 14:33:25]

Done.

 
   // Store HTTP Auth-related policies in this thread.
   std::string auth_android_negotiate_account_type_;
   std::string auth_server_whitelist_;
 
   // ProtocolHandlers and interceptors are stored here between
   // SetHandlersAndInterceptors() and the first GetURLRequestContext() call.
   content::ProtocolHandlerMap protocol_handlers_;
   content::URLRequestInterceptorScopedVector request_interceptors_;
 
   DISALLOW_COPY_AND_ASSIGN(AwURLRequestContextGetter);
 };
 
 }  // namespace android_webview
 
 #endif  // ANDROID_WEBVIEW_BROWSER_NET_AW_URL_REQUEST_CONTEXT_GETTER_H_