Fix a c_str() use-after-free bug in the chrome frame code.

chrome_frame/chrome_active_document.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Implementation of ChromeActiveDocument
 #include "chrome_frame/chrome_active_document.h"
 
 #include <hlink.h>
 #include <htiface.h>
 #include <initguid.h>
@@ skipping 913 matching lines @@
     return;
   }
   DWORD flags = 0;
   if (params.user_gesture)
     flags = NWMF_USERREQUESTED;
   else if (popup_allowed_)
     flags = NWMF_USERALLOWED;
 
   HRESULT hr = S_OK;
   if (popup_manager_) {
-    LPCWSTR popup_wnd_url = UTF8ToWide(params.url.spec()).c_str();
-    hr = popup_manager_->EvaluateNewWindow(popup_wnd_url, NULL, url_,
+    const std::wstring& url_wide = UTF8ToWide(params.url.spec());
+    hr = popup_manager_->EvaluateNewWindow(url_wide.c_str(), NULL, url_,
         NULL, FALSE, flags, 0);
   }
   // Allow popup
   if (hr == S_OK) {
     BaseActiveX::OnAttachExternalTab(tab_handle, params);
     return;
   }
 
   automation_client_->BlockExternalTab(params.cookie);
 }
@@ skipping 351 matching lines @@
     web_browser2->put_Height(dimensions_.height());
     web_browser2->put_Left(dimensions_.x());
     web_browser2->put_Top(dimensions_.y());
     web_browser2->put_MenuBar(VARIANT_FALSE);
     web_browser2->put_ToolBar(VARIANT_FALSE);
 
     dimensions_.set_height(0);
     dimensions_.set_width(0);
   }
 }