Fixed use-after-free in LoadCallback in bookmark_storage.cc

components/bookmarks/browser/bookmark_storage.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef COMPONENTS_BOOKMARKS_BROWSER_BOOKMARK_STORAGE_H_
 #define COMPONENTS_BOOKMARKS_BROWSER_BOOKMARK_STORAGE_H_
 
 #include "base/callback_forward.h"
 #include "base/files/file_path.h"
 #include "base/files/important_file_writer.h"
@@ skipping 141 matching lines @@
       const scoped_refptr<base::SequencedTaskRunner>& task_runner);
 
   // Schedules saving the bookmark bar model to disk.
   void ScheduleSave();
 
   // Notification the bookmark bar model is going to be deleted. If there is
   // a pending save, it is saved immediately.
   void BookmarkModelDeleted();
 
   // Callback from backend after loading the bookmark file.
-  void OnLoadFinished();
+  void OnLoadFinished(scoped_ptr<BookmarkLoadDetails> details);
 
   // ImportantFileWriter::DataSerializer implementation.
   virtual bool SerializeData(std::string* output) OVERRIDE;
 
  private:
   // Serializes the data and schedules save using ImportantFileWriter.
   // Returns true on successful serialization.
   bool SaveNow();
 
   // The model. The model is NULL once BookmarkModelDeleted has been invoked.
   BookmarkModel* model_;
 
   // Helper to write bookmark data safely.
   base::ImportantFileWriter writer_;
 
-  // See class description of BookmarkLoadDetails for details on this.
-  scoped_ptr<BookmarkLoadDetails> details_;
-
   // Sequenced task runner where file I/O operations will be performed at.
   scoped_refptr<base::SequencedTaskRunner> sequenced_task_runner_;
 
   base::WeakPtrFactory<BookmarkStorage> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(BookmarkStorage);
 };
 
 }  // namespace bookmarks
 
 #endif  // COMPONENTS_BOOKMARKS_BROWSER_BOOKMARK_STORAGE_H_