Address 2 crashes in download attribution code

chrome/browser/safe_browsing/safe_browsing_navigation_observer_manager.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_SAFE_BROWSING_SAFE_BROWSING_NAVIGATION_OBSERVER_MANAGER_H_
 #define CHROME_BROWSER_SAFE_BROWSING_SAFE_BROWSING_NAVIGATION_OBSERVER_MANAGER_H_
 
 #include "base/feature_list.h"
 #include "chrome/common/safe_browsing/csd.pb.h"
 #include "content/public/browser/notification_observer.h"
@@ skipping 14 matching lines @@
 // referrer for a specific download.
 // TODO(jialiul): For now, SafeBrowsingNavigationObserverManager also listens to
 // NOTIFICATION_RETARGETING as a way to detect cross frame/tab navigation.
 // Remove base class content::NotificationObserver when
 // WebContentsObserver::DidOpenRequestedURL() covers all retargeting cases.
 class SafeBrowsingNavigationObserverManager
     : public content::NotificationObserver,
       public base::RefCountedThreadSafe<SafeBrowsingNavigationObserverManager> {
  public:
   static const base::Feature kDownloadAttribution;
+  typedef std::vector<std::unique_ptr<ReferrerChainEntry>> ReferrerChain;
 
   // For UMA histogram counting. Do NOT change order.
   enum AttributionResult {
     SUCCESS = 1,                   // Identified referrer chain is not empty.
     SUCCESS_LANDING_PAGE = 2,      // Successfully identified landing page.
     SUCCESS_LANDING_REFERRER = 3,  // Successfully identified landing referrer.
     INVALID_URL = 4,
     NAVIGATION_EVENT_NOT_FOUND = 5,
 
     // Always at the end.
@@ skipping 38 matching lines @@
   // Based on the |target_url| and |target_tab_id|, trace back the observed
   // NavigationEvents in navigation_map_ to identify the sequence of navigations
   // leading to the target, with the coverage limited to
   // |user_gesture_count_limit| number of user gestures. Then convert these
   // identified NavigationEvents into ReferrerChainEntrys and append them to
   // |out_referrer_chain|.
   AttributionResult IdentifyReferrerChainForDownload(
       const GURL& target_url,
       int target_tab_id,  // -1 if tab id is not valid
       int user_gesture_count_limit,
-      std::vector<ReferrerChainEntry>* out_referrer_chain);
+      ReferrerChain* out_referrer_chain);
 
   // Based on the |initiating_frame_url| and its associated |tab_id|, trace back
   // the observed NavigationEvents in navigation_map_ to identify the sequence
   // of navigations leading to this |initiating_frame_url|. If this initiating
   // frame has a user gesture, we trace back with the coverage limited to
   // |user_gesture_count_limit|-1 number of user gestures, otherwise we trace
   // back |user_gesture_count_limit| number of user gestures. We then convert
   // these identified NavigationEvents into ReferrerChainEntrys and append them
   // to |out_referrer_chain|.
   AttributionResult IdentifyReferrerChainForPPAPIDownload(
       const GURL& initiating_frame_url,
       int tab_id,
       bool has_user_gesture,
       int user_gesture_count_limit,
-      std::vector<ReferrerChainEntry>* out_referrer_chain);
+      ReferrerChain* out_referrer_chain);
 
  private:
   friend class base::RefCountedThreadSafe<
       SafeBrowsingNavigationObserverManager>;
   friend class TestNavigationObserverManager;
   friend class SBNavigationObserverBrowserTest;
   friend class SBNavigationObserverTest;
 
   struct GurlHash {
     std::size_t operator()(const GURL& url) const {
@@ skipping 54 matching lines @@
   //   \   /
   //     B
   // In this case, FindNavigationEvent() will think url2 in Window B is the
   // referrer of about::blank in Window C since this navigation is more recent.
   // However, it does not prevent us to attribute url1 in Window A as the cause
   // of all these navigations.
   NavigationEvent* FindNavigationEvent(const GURL& target_url,
                                        const GURL& target_main_frame_url,
                                        int target_tab_id);
 
-  void AddToReferrerChain(std::vector<ReferrerChainEntry>* referrer_chain,
+  void AddToReferrerChain(ReferrerChain* referrer_chain,
                           NavigationEvent* nav_event,
                           ReferrerChainEntry::URLType type);
 
   // Helper function to get the remaining referrer chain when we've already
   // traced back |current_user_gesture_count| number of user gestures.
   // This function modifies the |out_referrer_chain| and |out_result|.
-  void GetRemainingReferrerChain(
-    NavigationEvent* last_nav_event_traced,
-    int current_user_gesture_count,
-    int user_gesture_count_limit,
-    std::vector<ReferrerChainEntry>* out_referrer_chain,
-    AttributionResult* out_result);
+  void GetRemainingReferrerChain(NavigationEvent* last_nav_event_traced,
+                                 int current_user_gesture_count,
+                                 int user_gesture_count_limit,
+                                 ReferrerChain* out_referrer_chain,
+                                 AttributionResult* out_result);
 
   // navigation_map_ keeps track of all the observed navigations. This map is
   // keyed on the resolved request url. In other words, in case of server
   // redirects, its key is the last server redirect url, otherwise, it is the
   // original target url. Since the same url can be requested multiple times
   // across different tabs and frames, the value of this map is a vector of
   // NavigationEvent ordered by navigation finish time.
   // Entries in navigation_map_ will be removed if they are older than 2 minutes
   // since their corresponding navigations finish.
   NavigationMap navigation_map_;
@@ skipping 12 matching lines @@
 
   content::NotificationRegistrar registrar_;
 
   base::OneShotTimer cleanup_timer_;
 
   DISALLOW_COPY_AND_ASSIGN(SafeBrowsingNavigationObserverManager);
 };
 }  // namespace safe_browsing
 
 #endif  // CHROME_BROWSER_SAFE_BROWSING_SAFE_BROWSING_NAVIGATION_OBSERVER_MANAGER_H_