[Sync] Address use-after-free in Directory::InsertEntry

components/sync/syncable/directory.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef COMPONENTS_SYNC_SYNCABLE_DIRECTORY_H_
 #define COMPONENTS_SYNC_SYNCABLE_DIRECTORY_H_
 
 #include <stddef.h>
 #include <stdint.h>
 
@@ skipping 482 matching lines @@
   // preserve sync preferences in DB on disk.
   void UnmarkDirtyEntry(WriteTransaction* trans, Entry* entry);
 
   // Clears |ids| and fills it with the ids of attachments that need to be
   // uploaded to the sync server.
   void GetAttachmentIdsToUpload(BaseTransaction* trans,
                                 ModelType type,
                                 AttachmentIdList* ids);
 
   // For new entry creation only.
-  bool InsertEntry(BaseWriteTransaction* trans, EntryKernel* entry);
+  bool InsertEntry(BaseWriteTransaction* trans,
+                   std::unique_ptr<EntryKernel> entry);
 
   // Update the attachment index for |metahandle| removing it from the index
   // under |old_metadata| entries and add it under |new_metadata| entries.
   void UpdateAttachmentIndex(const int64_t metahandle,
                              const sync_pb::AttachmentMetadata& old_metadata,
                              const sync_pb::AttachmentMetadata& new_metadata);
 
   virtual EntryKernel* GetEntryById(const Id& id);
   virtual EntryKernel* GetEntryByClientTag(const std::string& tag);
   EntryKernel* GetEntryByServerTag(const std::string& tag);
@@ skipping 36 matching lines @@
   // constructs a ScopedKernelLock before calling the corresponding private
   // overload with the held ScopedKernelLock.
 
   virtual EntryKernel* GetEntryByHandle(const ScopedKernelLock& lock,
                                         int64_t metahandle);
 
   virtual EntryKernel* GetEntryById(const ScopedKernelLock& lock, const Id& id);
 
   bool InsertEntry(const ScopedKernelLock& lock,
                    BaseWriteTransaction* trans,
-                   EntryKernel* entry);
+                   std::unique_ptr<EntryKernel> entry);
 
   // Remove each of |metahandle|'s attachment ids from index_by_attachment_id.
   void RemoveFromAttachmentIndex(
       const ScopedKernelLock& lock,
       const int64_t metahandle,
       const sync_pb::AttachmentMetadata& attachment_metadata);
 
   // Add each of |metahandle|'s attachment ids to the index_by_attachment_id.
   void AddToAttachmentIndex(
       const ScopedKernelLock& lock,
@@ skipping 96 matching lines @@
 
   base::WeakPtrFactory<Directory> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(Directory);
 };
 
 }  // namespace syncable
 }  // namespace syncer
 
 #endif  // COMPONENTS_SYNC_SYNCABLE_DIRECTORY_H_