Fix use-after-free in NavigationSimulator test util

content/public/test/navigation_simulator.cc

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/public/test/navigation_simulator.h"
 
 #include "base/bind.h"
 #include "base/memory/ptr_util.h"
 #include "base/run_loop.h"
 #include "content/browser/frame_host/navigation_handle_impl.h"
@@ skipping 212 matching lines @@
       << "NavigationSimulator::Commit cannot be called after the "
          "navigation has finished";
 
   if (state_ == INITIALIZATION)
     Start();
 
   PrepareCompleteCallbackOnHandle();
   if (IsBrowserSideNavigationEnabled() &&
       render_frame_host_->frame_tree_node()->navigation_request()) {
     render_frame_host_->PrepareForCommit();
+    // Synchronous failure can cause the navigation to finish here.
+    if (!handle_) {
+      state_ = FAILED;
+      return;
+    }
   }
 
   // Call NavigationHandle::WillProcessResponse if needed.
   // Note that the handle's state can be CANCELING if a throttle cancelled it
   // synchronously in PrepareForCommit.
   if (handle_->state_for_testing() < NavigationHandleImpl::CANCELING) {
     handle_->WillProcessResponse(
         render_frame_host_, scoped_refptr<net::HttpResponseHeaders>(),
         net::HttpResponseInfo::ConnectionInfo(), SSLStatus(), GlobalRequestID(),
         false /* should_replace_current_entry */, false /* is_download */,
@@ skipping 258 matching lines @@
 }
 
 void NavigationSimulator::ReadyToCommitNavigation(
     NavigationHandle* navigation_handle) {
   if (navigation_handle == handle_)
     num_ready_to_commit_called_++;
 }
 
 void NavigationSimulator::DidFinishNavigation(
     NavigationHandle* navigation_handle) {
-  if (navigation_handle == handle_)
+  if (navigation_handle == handle_) {
     num_did_finish_navigation_called_++;
+    handle_ = nullptr;
+  }
 }
 
 void NavigationSimulator::OnWillStartRequest() {
   num_will_start_request_called_++;
 }
 
 void NavigationSimulator::OnWillRedirectRequest() {
   num_will_redirect_request_called_++;
 }
 
@@ skipping 22 matching lines @@
 }
 
 void NavigationSimulator::PrepareCompleteCallbackOnHandle() {
   last_throttle_check_result_.reset();
   handle_->set_complete_callback_for_testing(
       base::Bind(&NavigationSimulator::OnThrottleChecksComplete,
                  weak_factory_.GetWeakPtr()));
 }
 
 }  // namespace content