Postpone deletion of (Password)AutofillAgent

components/autofill/content/renderer/autofill_agent.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/autofill/content/renderer/autofill_agent.h"
 
 #include <stddef.h>
 
 #include <tuple>
 
@@ skipping 294 matching lines @@
     return;
   }
 
   if (!element || !element->isEnabled() || element->isReadOnly() ||
       !element->isTextField())
     return;
 
   element_ = *element;
 }
 
+void AutofillAgent::OnDestruct() {
+  // As described in http://crbug.com/608100, there might be an AutofillAgent
+  // method in-progress lower on the stack. Destroying |this| would cause
+  // use-after-free once the lower stack frame becomes active. Instead, a task
+  // needs to be posted to delete this.
+  base::ThreadTaskRunnerHandle::Get()->DeleteSoon(FROM_HERE, this);
+}
+
 void AutofillAgent::FocusChangeComplete() {
   WebDocument doc = render_frame()->GetWebFrame()->document();
   WebElement focused_element;
   if (!doc.isNull())
     focused_element = doc.focusedElement();
 
   if (!focused_element.isNull() && password_generation_agent_ &&
       password_generation_agent_->FocusedNodeHasChanged(focused_element)) {
     is_generation_popup_possibly_visible_ = true;
     is_popup_possibly_visible_ = true;
@@ skipping 521 matching lines @@
 
 void AutofillAgent::LegacyAutofillAgent::OnDestruct() {
   // No-op. Don't delete |this|.
 }
 
 void AutofillAgent::LegacyAutofillAgent::FocusChangeComplete() {
   agent_->FocusChangeComplete();
 }
 
 }  // namespace autofill