Fix UaF of BlinkTestRunner caused by incorrect base::Unretained.

content/shell/renderer/layout_test/blink_test_runner.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/shell/renderer/layout_test/blink_test_runner.h"
 
 #include <stddef.h>
 #include <algorithm>
 #include <clocale>
 #include <cmath>
@@ skipping 885 matching lines @@
     Send(new ShellViewHostMsg_ImageDump(
         routing_id(), actual_pixel_hash, snapshot));
   }
 
   CaptureDumpComplete();
 }
 
 void BlinkTestRunner::CaptureDumpComplete() {
   render_view()->GetWebView()->mainFrame()->stopLoading();
 
-  base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::Bind(base::IgnoreResult(&BlinkTestRunner::Send),
-                            base::Unretained(this),
-                            new ShellViewHostMsg_TestFinished(routing_id())));
+  Send(new ShellViewHostMsg_TestFinished(routing_id()));

[Łukasz Anforowicz, 2016/04/06 22:45:28]

The asynchronous posting came from
https://chromium.googlesource.com/chromium/src/+/8b68e2bd35dbe83be805a8665a26...

I am not sure I understand why the indirection might be needed here in the past
- sending synchronously should be fine IMO, because:
1. I would expect that the act of sending should have no impact on layers above
IPC
2. Effect of sending an IPC is asynchronous (regardless whether Send is called
synchronously or posted asynchronously)

The new code seems ok to land to me:
1. tests still pass
2. no UaF
3. one less base::Unretained

WDYT?

 }
 
 mojom::LayoutTestBluetoothFakeAdapterSetter&
 BlinkTestRunner::GetBluetoothFakeAdapterSetter() {
   if (!bluetooth_fake_adapter_setter_) {
     RenderThread::Get()->GetServiceRegistry()->ConnectToRemoteService(
         mojo::GetProxy(&bluetooth_fake_adapter_setter_));
   }
   return *bluetooth_fake_adapter_setter_;
 }
@@ skipping 62 matching lines @@
   get_bluetooth_events_callbacks_.pop_front();
   callback.Run(events);
 }
 
 void BlinkTestRunner::ReportLeakDetectionResult(
     const LeakDetectionResult& report) {
   Send(new ShellViewHostMsg_LeakDetectionDone(routing_id(), report));
 }
 
 }  // namespace content