[Sync] Address use-after-free in Directory::InsertEntry

components/sync/syncable/mutable_entry.h

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef COMPONENTS_SYNC_SYNCABLE_MUTABLE_ENTRY_H_
 #define COMPONENTS_SYNC_SYNCABLE_MUTABLE_ENTRY_H_
 
 #include <stdint.h>
 
+#include <memory>
 #include <string>
 
 #include "base/macros.h"
 #include "components/sync/base/model_type.h"
 #include "components/sync/syncable/entry.h"
 #include "components/sync/syncable/metahandle_set.h"
 #include "components/sync/syncable/model_neutral_mutable_entry.h"
 
 namespace syncer {
 
 namespace syncable {
 
 enum Create { CREATE };
 
 class WriteTransaction;
 
 // A mutable meta entry.  Changes get committed to the database when the
 // WriteTransaction is destroyed.
 class MutableEntry : public ModelNeutralMutableEntry {
-  void Init(WriteTransaction* trans,
-            ModelType model_type,
-            const Id& parent_id,
-            const std::string& name);
-
  public:
   MutableEntry(WriteTransaction* trans, CreateNewUpdateItem, const Id& id);
   MutableEntry(WriteTransaction* trans,
                Create,
                ModelType model_type,
                const std::string& name);
   MutableEntry(WriteTransaction* trans,
                Create,
                ModelType model_type,
                const Id& parent_id,
@@ skipping 26 matching lines @@
   bool PutPredecessor(const Id& predecessor_id);
 
   void PutAttachmentMetadata(const sync_pb::AttachmentMetadata& value);
 
   // Update attachment metadata for |attachment_id| to indicate that this
   // attachment has been uploaded to the sync server.
   void MarkAttachmentAsOnServer(
       const sync_pb::AttachmentIdProto& attachment_id);
 
  private:
+  static std::unique_ptr<EntryKernel> CreateEntryKernel(
+      WriteTransaction* trans,
+      ModelType model_type,
+      const Id& parent_id,
+      const std::string& name);
+
   // Kind of redundant. We should reduce the number of pointers
   // floating around if at all possible. Could we store this in Directory?
   // Scope: Set on construction, never changed after that.
   WriteTransaction* const write_transaction_;
 
   DISALLOW_COPY_AND_ASSIGN(MutableEntry);
 };
 
 // This function sets only the flags needed to get this entry to sync.
 bool MarkForSyncing(syncable::MutableEntry* e);
 
 }  // namespace syncable
 }  // namespace syncer
 
 #endif  // COMPONENTS_SYNC_SYNCABLE_MUTABLE_ENTRY_H_