Fix a use-after-free of SaveFileCreateInfo in SaveFileManager.

content/browser/download/save_file_manager.cc

Index: content/browser/download/save_file_manager.cc
diff --git a/content/browser/download/save_file_manager.cc b/content/browser/download/save_file_manager.cc
index 01874d0f6895684c63b8f167c479d5d1dfc5957d..d1684d7ca943cf662c1b4e7fa275d1f59e979c08 100644
--- a/content/browser/download/save_file_manager.cc
+++ b/content/browser/download/save_file_manager.cc
@@ -47,6 +47,7 @@ void SaveFileManager::OnShutdown() {
 }
 
 SaveFile* SaveFileManager::LookupSaveFile(int save_item_id) {
+  DCHECK_CURRENTLY_ON(BrowserThread::FILE);
   SaveFileMap::iterator it = save_file_map_.find(save_item_id);
   return it == save_file_map_.end() ? NULL : it->second;
 }
@@ -165,7 +166,7 @@ void SaveFileManager::StartSave(SaveFileCreateInfo* info) {
 
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
-      base::Bind(&SaveFileManager::OnStartSave, this, info));
+      base::Bind(&SaveFileManager::OnStartSave, this, *info));
 }
 
 // We do forward an update to the UI thread here, since we do not use timer to
@@ -219,23 +220,23 @@ void SaveFileManager::SaveFinished(int save_item_id,
 
 // Notifications sent from the file thread and run on the UI thread.
 
-void SaveFileManager::OnStartSave(const SaveFileCreateInfo* info) {
+void SaveFileManager::OnStartSave(const SaveFileCreateInfo info) {

[Randy Smith (Not in Mondays), 2015/12/12 20:32:11]

I'd make this a const&.  I believe the Bind & PostTask stuff handles that
properly and that it'll reduce copies.  And it's consistent with the rest of the
code base.

[Łukasz Anforowicz, 2015/12/14 17:40:12]

You're right, const-ref reads better and is more consistent with the rest of the
code and the style guide.  And yes - it still binds to the callback by value (an
explicit base::ConstRef from bind_helpers.h is needed to bind by
reference/pointer).

Done.

   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   SavePackage* save_package = GetSavePackageFromRenderIds(
-      info->render_process_id, info->render_frame_routing_id);
+      info.render_process_id, info.render_frame_routing_id);
   if (!save_package) {
     // Cancel this request.
-    SendCancelRequest(info->save_item_id);
+    SendCancelRequest(info.save_item_id);
     return;
   }
 
   // Insert started saving job to tracking list.
-  SavePackageMap::iterator sit = packages_.find(info->save_item_id);
+  SavePackageMap::iterator sit = packages_.find(info.save_item_id);
   DCHECK(sit == packages_.end());
-  packages_[info->save_item_id] = save_package;
+  packages_[info.save_item_id] = save_package;
 
   // Forward this message to SavePackage.
-  save_package->StartSave(info);
+  save_package->StartSave(&info);
 }
 
 void SaveFileManager::OnUpdateSaveProgress(int save_item_id,