Fix UAF in closures posted from InProcessWorkerObjectProxy

third_party/WebKit/Source/core/workers/InProcessWorkerObjectProxy.h

Index: third_party/WebKit/Source/core/workers/InProcessWorkerObjectProxy.h
diff --git a/third_party/WebKit/Source/core/workers/InProcessWorkerObjectProxy.h b/third_party/WebKit/Source/core/workers/InProcessWorkerObjectProxy.h
index a59dffdc856554915aba5e9e7b73ab3fd32627c8..e1ee9a316a7b8f0e2396018c780eaa28127ee5a8 100644
--- a/third_party/WebKit/Source/core/workers/InProcessWorkerObjectProxy.h
+++ b/third_party/WebKit/Source/core/workers/InProcessWorkerObjectProxy.h
@@ -64,7 +64,7 @@ class CORE_EXPORT InProcessWorkerObjectProxy : public WorkerReportingProxy {
 
  public:
   static std::unique_ptr<InProcessWorkerObjectProxy> create(
-      InProcessWorkerMessagingProxy*);
+      const WeakPtr<InProcessWorkerMessagingProxy>&);
   ~InProcessWorkerObjectProxy() override;
 
   void postMessageToWorkerObject(PassRefPtr<SerializedScriptValue>,
@@ -89,7 +89,7 @@ class CORE_EXPORT InProcessWorkerObjectProxy : public WorkerReportingProxy {
   void didTerminateWorkerThread() override;
 
  protected:
-  InProcessWorkerObjectProxy(InProcessWorkerMessagingProxy*);
+  InProcessWorkerObjectProxy(const WeakPtr<InProcessWorkerMessagingProxy>&);
   virtual ExecutionContext* getExecutionContext();
 
  private:
@@ -103,6 +103,11 @@ class CORE_EXPORT InProcessWorkerObjectProxy : public WorkerReportingProxy {
   // This object always outlives this proxy.
   InProcessWorkerMessagingProxy* m_messagingProxy;
 
+  // No guarantees about the lifetimes of tasks posted by this proxy wrt the
+  // InProcessWorkerMessagingProxy so a weak pointer must be used when posting
+  // the tasks.
+  WeakPtr<InProcessWorkerMessagingProxy> m_messagingProxyWeakPtr;
+
   // Used for checking pending activities on the worker global scope. This is
   // cancelled when the worker global scope is destroyed.
   std::unique_ptr<Timer<InProcessWorkerObjectProxy>> m_timer;