Fix UAF in chrome_pdf::Instance::GetURL()

pdf/instance.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "pdf/instance.h"
 
 #include <algorithm>  // for min()
 #define _USE_MATH_DEFINES  // for M_PI
 #include <cmath>      // for log() and pow()
 #include <math.h>
@@ skipping 289 matching lines @@
   pp::Module::Get()->AddPluginInterface(kPPPPdfInterface, &ppp_private);
   AddPerInstanceObject(kPPPPdfInterface, this);
 
   RequestFilteringInputEvents(PP_INPUTEVENT_CLASS_MOUSE);
   RequestFilteringInputEvents(PP_INPUTEVENT_CLASS_WHEEL);
   RequestFilteringInputEvents(PP_INPUTEVENT_CLASS_KEYBOARD);
   RequestFilteringInputEvents(PP_INPUTEVENT_CLASS_TOUCH);
 }
 
 Instance::~Instance() {
+  // The engine may try to access this instance during its destruction.
+  // Make sure this happens early while the instance is still intact.
+  engine_.reset();
   RemovePerInstanceObject(kPPPPdfInterface, this);
 }
 
 bool Instance::Init(uint32_t argc, const char* argn[], const char* argv[]) {
   // For now, we hide HiDPI support behind a flag.
   if (pp::PDF::IsFeatureEnabled(this, PP_PDFFEATURE_HIDPI))
     hidpi_enabled_ = true;
 
   printing_enabled_ = pp::PDF::IsFeatureEnabled(this, PP_PDFFEATURE_PRINTING);
   if (printing_enabled_) {
@@ skipping 2399 matching lines @@
   return instance_->HasScriptableMethod(name, exception);
 }
 
 pp::Var PDFScriptableObject::Call(const pp::Var& method,
                                   const std::vector<pp::Var>& args,
                                   pp::Var* exception) {
   return instance_->CallScriptableMethod(method, args, exception);
 }
 
 }  // namespace chrome_pdf