[android_webview] Fix UAF in request interception code.

android_webview/browser/intercepted_request_data.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef ANDROID_WEBVIEW_BROWSER_INTERCEPTED_REQUEST_DATA_H_
 #define ANDROID_WEBVIEW_BROWSER_INTERCEPTED_REQUEST_DATA_H_
 
 #include <string>
 
 #include "base/memory/scoped_ptr.h"
+#include "base/memory/ref_counted.h"
 
 namespace net {
 class URLRequest;
 class URLRequestJob;
 class NetworkDelegate;
 }
 
 namespace android_webview {
 
+class InterceptedRequestData;
+
 // This class represents the Java-side data that is to be used to complete a
 // particular URLRequest.
 class InterceptedRequestData {
  public:
+  typedef base::RefCountedData<scoped_ptr<InterceptedRequestData> > Holder;
   virtual ~InterceptedRequestData() {}
 
-  // This creates a URLRequestJob for the |request| wich will read data from
-  // the |intercepted_request_data| structure (instead of going to the network
-  // or to the cache).
-  // The newly created job does not take ownership of |this|.
-  virtual net::URLRequestJob* CreateJobFor(
+  // This creates a URLRequestJob for the |request| wich will read data from the
+  // |intercepted_request_data| structure obtained from |holder| (instead of
+  // going to the network or to the cache).
+  static net::URLRequestJob* CreateJobFor(
+      scoped_refptr<Holder> holder,
       net::URLRequest* request,
-      net::NetworkDelegate* network_delegate) const = 0;
+      net::NetworkDelegate* network_delegate);
 
  protected:
   InterceptedRequestData() {}
 
  private:
   DISALLOW_COPY_AND_ASSIGN(InterceptedRequestData);
 };
 
 } // namespace android_webview
 
 #endif  // ANDROID_WEBVIEW_BROWSER_INTERCEPTED_REQUEST_DATA_H_