Avoid use-after-free in FormFetcherImpl

ios/chrome/browser/passwords/credential_manager.mm

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/chrome/browser/passwords/credential_manager.h"
 
 #include <utility>
 
 #import "base/ios/weak_nsobject.h"
 #include "base/mac/bind_objc_block.h"
 #include "base/memory/scoped_vector.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/threading/thread_task_runner_handle.h"
+#include "components/password_manager/core/browser/form_saver.h"
 #include "components/password_manager/core/browser/password_store_consumer.h"
 #include "components/password_manager/core/common/credential_manager_types.h"
 #include "components/password_manager/core/common/password_manager_pref_names.h"
 #import "ios/chrome/browser/passwords/js_credential_manager.h"
 #import "ios/web/public/url_scheme_util.h"
 #include "ios/web/public/web_state/credential.h"
 #include "ios/web/public/web_state/url_verification_constants.h"
 #include "ios/web/public/web_state/web_state.h"
 #include "url/origin.h"
 
@@ skipping 175 matching lines @@
           CredentialInfoFromWebCredential(credential), page_url));
   form->skip_zero_click = !IsZeroClickAllowed();
 
   // TODO(mkwst): This is a stub; we should be checking the PasswordStore to
   // determine whether or not the credential exists, and calling UpdateLogin
   // accordingly.
   form_manager_.reset(
       new password_manager::CredentialManagerPasswordFormManager(
           client_, driver_->AsWeakPtr(),
           *password_manager::CreateObservedPasswordFormFromOrigin(page_url),
-          std::move(form), this));
+          std::move(form), this, nullptr, nullptr));
 }
 
 void CredentialManager::SignedOut(int request_id, const GURL& source_url) {
   // Invoked when the page invokes navigator.credentials.notifySignedOut, this
   // function notifies the PasswordStore that zero-click sign-in should be
   // disabled for the current page origin.
   DCHECK_GE(request_id, 0);
 
   // Requests from untrusted origins should be rejected.
   GURL page_url;
@@ skipping 142 matching lines @@
 bool CredentialManager::GetUrlWithAbsoluteTrust(GURL* page_url) {
   web::URLVerificationTrustLevel trust_level =
       web::URLVerificationTrustLevel::kNone;
   const GURL possibly_untrusted_url(web_state()->GetCurrentURL(&trust_level));
   if (trust_level == web::URLVerificationTrustLevel::kAbsolute) {
     *page_url = possibly_untrusted_url;
     return true;
   }
   return false;
 }