Avoid use-after-free in FormFetcherImpl

components/password_manager/content/browser/credential_manager_impl.cc

Index: components/password_manager/content/browser/credential_manager_impl.cc
diff --git a/components/password_manager/content/browser/credential_manager_impl.cc b/components/password_manager/content/browser/credential_manager_impl.cc
index 7e6e528cdfb5fcb01a0ad3911bc271b6e3cf5008..9ebdc3df2a9a113469ea13e1b6eeff7b47f975ff 100644
--- a/components/password_manager/content/browser/credential_manager_impl.cc
+++ b/components/password_manager/content/browser/credential_manager_impl.cc
@@ -7,6 +7,7 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/memory/ptr_util.h"
 #include "base/metrics/user_metrics.h"
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
@@ -15,6 +16,8 @@
 #include "components/password_manager/content/browser/content_password_manager_driver_factory.h"
 #include "components/password_manager/core/browser/affiliated_match_helper.h"
 #include "components/password_manager/core/browser/credential_manager_logger.h"
+#include "components/password_manager/core/browser/form_fetcher.h"
+#include "components/password_manager/core/browser/form_saver.h"

[vasilii, 2016/12/21 11:00:49]

I think both headers are unused.

[vabr (Chromium), 2016/12/21 11:35:25]

They are not. On line 82, there are two nullptr passed to a function call in
place of pointers to FormFetcher and FormSaver. In particular, the FormSaver is
a unique_ptr, so there the header is needed to know how to create it based on
nullptr. The other one is raw, so I can drop that header. (Done.)

 #include "components/password_manager/core/browser/password_manager_client.h"
 #include "components/password_manager/core/browser/password_manager_metrics_util.h"
 #include "components/password_manager/core/browser/password_manager_util.h"
@@ -74,9 +77,9 @@ void CredentialManagerImpl::Store(const CredentialInfo& credential,
   std::unique_ptr<autofill::PasswordForm> form(
       CreatePasswordFormFromCredentialInfo(credential, origin));
 
-  form_manager_.reset(new CredentialManagerPasswordFormManager(
+  form_manager_ = base::MakeUnique<CredentialManagerPasswordFormManager>(
       client_, GetDriver(), *CreateObservedPasswordFormFromOrigin(origin),
-      std::move(form), this));
+      std::move(form), this, nullptr, nullptr);
 }
 
 void CredentialManagerImpl::OnProvisionalSaveComplete() {