Remove ListValue::Append(raw ptr) on Android

chrome/browser/ui/webui/offline/offline_internals_ui_message_handler.cc

Index: chrome/browser/ui/webui/offline/offline_internals_ui_message_handler.cc
diff --git a/chrome/browser/ui/webui/offline/offline_internals_ui_message_handler.cc b/chrome/browser/ui/webui/offline/offline_internals_ui_message_handler.cc
index 77de1286236cd715835c02ffeca5618ca3ba0608..2f1680930c79d8c03c9243414d190d3da1a28d6b 100644
--- a/chrome/browser/ui/webui/offline/offline_internals_ui_message_handler.cc
+++ b/chrome/browser/ui/webui/offline/offline_internals_ui_message_handler.cc
@@ -6,10 +6,12 @@
 
 #include <stdint.h>
 #include <stdlib.h>
+#include <utility>
 #include <vector>
 
 #include "base/bind.h"
 #include "base/guid.h"
+#include "base/memory/ptr_util.h"
 #include "base/strings/string_number_conversions.h"

[jdoerrie, 2017/04/12 16:08:55]

#include "base/values.h"

[vabr (Chromium), 2017/04/12 16:40:52]

Done.

 #include "chrome/browser/android/offline_pages/offline_page_model_factory.h"
 #include "chrome/browser/android/offline_pages/request_coordinator_factory.h"
@@ -133,8 +135,8 @@ void OfflineInternalsUIMessageHandler::HandleStoredPagesCallback(
   base::ListValue results;
 
   for (const auto& page : pages) {
-    base::DictionaryValue* offline_page = new base::DictionaryValue();
-    results.Append(offline_page);
+    auto offline_page = base::MakeUnique<base::DictionaryValue>();
+    results.Append(std::move(offline_page));

[jdoerrie, 2017/04/12 16:08:55]

This moves out of offline_page. Move this line to the end of this block.

[vabr (Chromium), 2017/04/12 16:40:52]

Oops, thanks for catching!

     offline_page->SetString("onlineUrl", page.url.spec());
     offline_page->SetString("namespace", page.client_id.name_space);
     offline_page->SetDouble("size", page.file_size);
@@ -155,8 +157,8 @@ void OfflineInternalsUIMessageHandler::HandleRequestQueueCallback(
   base::ListValue save_page_requests;
   if (result == offline_pages::GetRequestsResult::SUCCESS) {
     for (const auto& request : requests) {
-      base::DictionaryValue* save_page_request = new base::DictionaryValue();
-      save_page_requests.Append(save_page_request);
+      auto save_page_request = base::MakeUnique<base::DictionaryValue>();
+      save_page_requests.Append(std::move(save_page_request));

[jdoerrie, 2017/04/12 16:08:55]

Same here. I am surprised I didn't hit this code during development of r463684,
this code should result in a use-after-free as is.

[vabr (Chromium), 2017/04/12 16:40:52]

I guess that's either lack of test coverage in this code, or the unfortunate
property of use-after-free that it sometimes works fine by accident.

In any case, I'm wondering what I did in this file to not notice it :(, thanks
for your careful review.

       save_page_request->SetString("onlineUrl", request->url().spec());
       save_page_request->SetDouble("creationTime",
                                    request->creation_time().ToJsTime());