Fixed use-after-free in LoadCallback in bookmark_storage.cc

components/bookmarks/browser/bookmark_storage.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/bookmarks/browser/bookmark_storage.h"
 
 #include "base/bind.h"
 #include "base/compiler_specific.h"
 #include "base/file_util.h"
 #include "base/json/json_file_value_serializer.h"
@@ skipping 31 matching lines @@
     if (node->url().is_valid())
       details->index()->Add(node);
   } else {
     for (int i = 0; i < node->child_count(); ++i)
       AddBookmarksToIndex(details, node->GetChild(i));
   }
 }
 
 void LoadCallback(const base::FilePath& path,
                   const base::WeakPtr<BookmarkStorage>& storage,
-                  BookmarkLoadDetails* details,
+                  scoped_ptr<BookmarkLoadDetails> details,
                   base::SequencedTaskRunner* task_runner) {
   startup_metric_utils::ScopedSlowStartupUMA
       scoped_timer("Startup.SlowStartupBookmarksLoad");
   bool load_index = false;
   bool bookmark_file_exists = base::PathExists(path);
   if (bookmark_file_exists) {
     JSONFileValueSerializer serializer(path);
     scoped_ptr<base::Value> root(serializer.Deserialize(NULL, NULL));
 
     if (root.get()) {
@@ skipping 26 matching lines @@
   const BookmarkPermanentNodeList& extra_nodes = details->extra_nodes();
   for (size_t i = 0; i < extra_nodes.size(); ++i) {
     if (!extra_nodes[i]->empty()) {
       load_index = true;
       break;
     }
   }
 
   if (load_index) {
     TimeTicks start_time = TimeTicks::Now();
-    AddBookmarksToIndex(details, details->bb_node());
-    AddBookmarksToIndex(details, details->other_folder_node());
-    AddBookmarksToIndex(details, details->mobile_folder_node());
+    AddBookmarksToIndex(details.get(), details->bb_node());
+    AddBookmarksToIndex(details.get(), details->other_folder_node());
+    AddBookmarksToIndex(details.get(), details->mobile_folder_node());
     for (size_t i = 0; i < extra_nodes.size(); ++i)
-      AddBookmarksToIndex(details, extra_nodes[i]);
+      AddBookmarksToIndex(details.get(), extra_nodes[i]);
     UMA_HISTOGRAM_TIMES("Bookmarks.CreateBookmarkIndexTime",
                         TimeTicks::Now() - start_time);
   }
 
   task_runner->PostTask(FROM_HERE,
-                        base::Bind(&BookmarkStorage::OnLoadFinished, storage));
+                        base::Bind(&BookmarkStorage::OnLoadFinished, storage,
+                                   base::Passed(&details)));
 }
 
 }  // namespace
 
 // BookmarkLoadDetails ---------------------------------------------------------
 
 BookmarkLoadDetails::BookmarkLoadDetails(
     BookmarkPermanentNode* bb_node,
     BookmarkPermanentNode* other_folder_node,
     BookmarkPermanentNode* mobile_folder_node,
@@ skipping 35 matching lines @@
 }
 
 BookmarkStorage::~BookmarkStorage() {
   if (writer_.HasPendingWrite())
     writer_.DoScheduledWrite();
 }
 
 void BookmarkStorage::LoadBookmarks(
     scoped_ptr<BookmarkLoadDetails> details,
     const scoped_refptr<base::SequencedTaskRunner>& task_runner) {
-  DCHECK(!details_.get());
-  DCHECK(details);
-  details_ = details.Pass();
   sequenced_task_runner_->PostTask(FROM_HERE,
                                    base::Bind(&LoadCallback,
                                               writer_.path(),
                                               weak_factory_.GetWeakPtr(),
-                                              details_.get(),
+                                              base::Passed(&details),
                                               task_runner));
 }
 
 void BookmarkStorage::ScheduleSave() {
   writer_.ScheduleWrite(this);
 }
 
 void BookmarkStorage::BookmarkModelDeleted() {
   // We need to save now as otherwise by the time SaveNow is invoked
   // the model is gone.
   if (writer_.HasPendingWrite())
     SaveNow();
   model_ = NULL;
 }
 
 bool BookmarkStorage::SerializeData(std::string* output) {
   BookmarkCodec codec;
   scoped_ptr<base::Value> value(codec.Encode(model_));
   JSONStringValueSerializer serializer(output);
   serializer.set_pretty_print(true);
   return serializer.Serialize(*(value.get()));
 }
 
-void BookmarkStorage::OnLoadFinished() {
+void BookmarkStorage::OnLoadFinished(scoped_ptr<BookmarkLoadDetails> details) {
   if (!model_)
     return;
 
-  model_->DoneLoading(details_.Pass());
+  model_->DoneLoading(details.Pass());
 }
 
 bool BookmarkStorage::SaveNow() {
   if (!model_ || !model_->loaded()) {
     // We should only get here if we have a valid model and it's finished
     // loading.
     NOTREACHED();
     return false;
   }
 
   std::string data;
   if (!SerializeData(&data))
     return false;
   writer_.WriteNow(data);
   return true;
 }
 
 }  // namespace bookmarks