Allow dynamic updating of authentication policies

android_webview/browser/net/aw_url_request_context_getter.h

Index: android_webview/browser/net/aw_url_request_context_getter.h
diff --git a/android_webview/browser/net/aw_url_request_context_getter.h b/android_webview/browser/net/aw_url_request_context_getter.h
index 06ddad5c63f2bb3bf9062351716a3c51945307a2..b0aed2191ccdd5c301f24443dd499143024bda07 100644
--- a/android_webview/browser/net/aw_url_request_context_getter.h
+++ b/android_webview/browser/net/aw_url_request_context_getter.h
@@ -19,12 +19,12 @@ namespace net {
 class CookieStore;
 class HostResolver;
 class HttpAuthHandlerFactory;
+class HttpAuthPreferences;
 class HttpUserAgentSettings;
 class NetLog;
 class ProxyConfigService;
 class URLRequestContext;
 class URLRequestJobFactory;
-class URLSecurityManager;
 }
 
 namespace android_webview {
@@ -82,9 +82,9 @@ class AwURLRequestContextGetter : public net::URLRequestContextGetter {
   scoped_ptr<net::HttpUserAgentSettings> http_user_agent_settings_;
   scoped_ptr<net::URLRequestContext> url_request_context_;
 
-  // URLSecurityManager associated with the negotiate auth handler. It is
-  // configured to follow the auth_server_whitelist_
-  scoped_ptr<net::URLSecurityManager> url_security_manager_;
+  // http_auth_preferences_ holds the preferences for the negotiate
+  // authenticator.
+  scoped_ptr<net::HttpAuthPreferences> http_auth_preferences_;

[asanka, 2015/12/01 05:30:03]

The scoped_ptr<net::URLRequestContext> in line 83 actually is-a
ContainerURLRequestContext that bundles a net::URLRequestContextStorage which
owns a net::HttpAuthHandlerRegistryFactory which holds a reference to the
HttpAuthPreferences object owned by http_auth_preferences_.

However the destruction order for the AwURLRequestContextGetter results in
freeing the owned http_auth_preferences_ object prior to destroying the
url_request_context_ object. By the time the url_request_context_ is destroyed,
its contained auth handler factory references freed memory.

Could you move the http_auth_preferences_ definition above url_request_context_
so that the destruction order is safe?

[aberent, 2015/12/01 14:33:25]

Done.

 
   // Store HTTP Auth-related policies in this thread.
   std::string auth_android_negotiate_account_type_;