Fix read-after-free when loading two search engines with the same keyword.

chrome/browser/search_engines/template_url_service.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_SEARCH_ENGINES_TEMPLATE_URL_SERVICE_H_
 #define CHROME_BROWSER_SEARCH_ENGINES_TEMPLATE_URL_SERVICE_H_
 
 #include <list>
 #include <map>
 #include <set>
@@ skipping 407 matching lines @@
 
   // Removes the supplied template_url from the keyword maps. This searches
   // through all entries in the keyword map and does not generate the host or
   // keyword. This is used when the cached content of the TemplateURL changes.
   void RemoveFromKeywordMapByPointer(TemplateURL* template_url);
 
   void AddToMaps(TemplateURL* template_url);
 
   // Sets the keywords. This is used once the keywords have been loaded.
   // This does NOT notify the delegate or the database.
-  void SetTemplateURLs(const TemplateURLVector& urls);
+  //
+  // This transfers ownership of the elements in |urls| to |this|, and may
+  // delete some elements, so it's not safe for callers to access any elements
+  // after calling; to reinforce this, this function clears |urls| on exit.
+  void SetTemplateURLs(TemplateURLVector* urls);
 
   // Transitions to the loaded state.
   void ChangeToLoadedState();
 
   // If there is a notification service, sends TEMPLATE_URL_SERVICE_LOADED
   // notification.
   void NotifyLoaded();
 
   // Saves enough of url to preferences so that it can be loaded from
   // preferences on start up.
@@ skipping 169 matching lines @@
   // Goes through a vector of TemplateURLs and ensure that both the in-memory
   // and database copies have valid sync_guids. This is to fix crbug.com/102038,
   // where old entries were being pushed to Sync without a sync_guid.
   void PatchMissingSyncGUIDs(TemplateURLVector* template_urls);
 
   void OnSyncedDefaultSearchProviderGUIDChanged();
 
   // Adds |template_urls| to |template_urls_| and sets up the default search
   // provider.  If |default_search_provider| is non-NULL, it must refer to one
   // of the |template_urls|, and will be used as the new default.
+  //
+  // This transfers ownership of the elements in |urls| to |this|, and may
+  // delete some elements, so it's not safe for callers to access any elements
+  // after calling; to reinforce this, this function clears |urls| on exit.

[beaudoin, 2013/09/14 03:24:03]

Nit: |urls| --> |template_urls|

[Peter Kasting, 2013/09/16 21:10:12]

Done.

   void AddTemplateURLsAndSetupDefaultEngine(
       TemplateURLVector* template_urls,
       TemplateURL* default_search_provider);
 
   // If there is no current default search provider, sets the default to the
   // result of calling FindNewDefaultSearchProvider().
   void EnsureDefaultSearchProviderExists();
 
   // Returns a new TemplateURL for the given extension.
   TemplateURL* CreateTemplateURLForExtension(
@@ skipping 87 matching lines @@
 
   // This is used to log the origin of changes to the default search provider.
   // We set this value to increasingly specific values when we know what is the
   // cause/origin of a default search change.
   DefaultSearchChangeOrigin dsp_change_origin_;
 
   DISALLOW_COPY_AND_ASSIGN(TemplateURLService);
 };
 
 #endif  // CHROME_BROWSER_SEARCH_ENGINES_TEMPLATE_URL_SERVICE_H_