Address 2 crashes in download attribution code

chrome/browser/safe_browsing/download_protection_service.cc

Index: chrome/browser/safe_browsing/download_protection_service.cc
diff --git a/chrome/browser/safe_browsing/download_protection_service.cc b/chrome/browser/safe_browsing/download_protection_service.cc
index 66ac0cdbda3bba02fdfda9f6cebc23ea611f83cc..1d3744a195642cc6dc0d7a7365384f113846a20f 100644
--- a/chrome/browser/safe_browsing/download_protection_service.cc
+++ b/chrome/browser/safe_browsing/download_protection_service.cc
@@ -1834,7 +1834,7 @@ void DownloadProtectionService::AddReferrerChainToClientDownloadRequest(
   UMA_HISTOGRAM_BOOLEAN(
       "SafeBrowsing.ReferrerHasInvalidTabID.DownloadAttribution",
       download_tab_id == -1);
-  std::vector<ReferrerChainEntry> attribution_chain;
+  SafeBrowsingNavigationObserverManager::ReferrerChain attribution_chain;
   SafeBrowsingNavigationObserverManager::AttributionResult result =
       navigation_observer_manager_->IdentifyReferrerChainForDownload(
           download_url,
@@ -1847,8 +1847,8 @@ void DownloadProtectionService::AddReferrerChainToClientDownloadRequest(
   UMA_HISTOGRAM_ENUMERATION(
       "SafeBrowsing.ReferrerAttributionResult.DownloadAttribution", result,
       SafeBrowsingNavigationObserverManager::ATTRIBUTION_FAILURE_TYPE_MAX);
-  for (auto entry : attribution_chain)
-    out_request->add_referrer_chain()->Swap(&entry);
+  for (auto it = attribution_chain.begin(); it != attribution_chain.end(); it++)

[Nathan Parker, 2017/01/10 01:25:13]

Could this be

for (auto& entry : attribution_chain) {
  .. Swap(it.release())
}
?

Actually, I think neither is valid... Swap() doesn't take ownership of the
pointer -- it swaps the innards of the proto (internal pointer, I think).

So maybe you'd want

for (auto& entry : attribution_chain) {
  ... Swap(entry.get())
}
and then let attribution_chain go out of scope, so all the unique_ptrs will get
deleted.

[Jialiu Lin, 2017/01/10 02:15:12]

You're right. Done.

+    out_request->add_referrer_chain()->Swap(it->release());
 }
 
 void DownloadProtectionService::AddReferrerChainToPPAPIClientDownloadRequest(
@@ -1865,7 +1865,7 @@ void DownloadProtectionService::AddReferrerChainToPPAPIClientDownloadRequest(
   UMA_HISTOGRAM_BOOLEAN(
       "SafeBrowsing.ReferrerHasInvalidTabID.DownloadAttribution",
       tab_id == -1);
-  std::vector<ReferrerChainEntry> attribution_chain;
+  SafeBrowsingNavigationObserverManager::ReferrerChain attribution_chain;
   SafeBrowsingNavigationObserverManager::AttributionResult result =
       navigation_observer_manager_->IdentifyReferrerChainForPPAPIDownload(
           initiating_frame_url,
@@ -1879,8 +1879,8 @@ void DownloadProtectionService::AddReferrerChainToPPAPIClientDownloadRequest(
   UMA_HISTOGRAM_ENUMERATION(
       "SafeBrowsing.ReferrerAttributionResult.PPAPIDownloadAttribution", result,
       SafeBrowsingNavigationObserverManager::ATTRIBUTION_FAILURE_TYPE_MAX);
-  for (auto entry : attribution_chain)
-    out_request->add_referrer_chain()->Swap(&entry);
+  for (auto it = attribution_chain.begin(); it != attribution_chain.end(); it++)
+    out_request->add_referrer_chain()->Swap(it->release());
 }
 
 }  // namespace safe_browsing