Fix UAF on singleton service instances

services/service_manager/service_manager.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SERVICES_SERVICE_MANAGER_SERVICE_MANAGER_H_
 #define SERVICES_SERVICE_MANAGER_SERVICE_MANAGER_H_
 
 #include <map>
 #include <memory>
 #include <vector>
@@ skipping 101 matching lines @@
   // bounded by that of |instance|. The connection will be cancelled dropped if
   // |instance| is destroyed.
   void Connect(std::unique_ptr<ConnectParams> params,
                mojom::ServicePtr service,
                base::WeakPtr<Instance> source_instance);
 
   // Returns a running instance matching |identity|. This might be an instance
   // running as a different user if one is available that services all users.
   Instance* GetExistingInstance(const Identity& identity) const;
 
+  // Erases any identities mapping to |instance|. Following this call it is
+  // impossible for any call to GetExistingInstance() to return |instance|.
+  void EraseInstanceIdentity(Instance* instance);
+
   void NotifyServiceStarted(const Identity& identity, base::ProcessId pid);
   void NotifyServiceFailedToStart(const Identity& identity);
 
   // Attempt to complete the connection requested by |params| by connecting to
   // an existing instance. If there is an existing instance, |params| is taken,
   // and this function returns true.
   bool ConnectToExistingInstance(std::unique_ptr<ConnectParams>* params);
 
   Instance* CreateInstance(const Identity& source,
                            const Identity& target,
@@ skipping 52 matching lines @@
   base::WeakPtrFactory<ServiceManager> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(ServiceManager);
 };
 
 mojom::Connector::ConnectCallback EmptyConnectCallback();
 
 }  // namespace service_manager
 
 #endif  // SERVICES_SERVICE_MANAGER_SERVICE_MANAGER_H_