[android_webview] Fix UAF in request interception code.

android_webview/browser/intercepted_request_data.h

Index: android_webview/browser/intercepted_request_data.h
diff --git a/android_webview/browser/intercepted_request_data.h b/android_webview/browser/intercepted_request_data.h
index 672833c09e7df108a36c1b5025e760502390ce8e..3e67d0eb83eda3cd627beeb9b6e724076ffc57e2 100644
--- a/android_webview/browser/intercepted_request_data.h
+++ b/android_webview/browser/intercepted_request_data.h
@@ -8,6 +8,7 @@
 #include <string>
 
 #include "base/memory/scoped_ptr.h"
+#include "base/memory/ref_counted.h"
 
 namespace net {
 class URLRequest;
@@ -17,19 +18,22 @@ class NetworkDelegate;
 
 namespace android_webview {
 
+class InterceptedRequestData;
+
 // This class represents the Java-side data that is to be used to complete a
 // particular URLRequest.
 class InterceptedRequestData {
  public:
+  typedef base::RefCountedData<scoped_ptr<InterceptedRequestData> > Holder;
   virtual ~InterceptedRequestData() {}
 
-  // This creates a URLRequestJob for the |request| wich will read data from
-  // the |intercepted_request_data| structure (instead of going to the network
-  // or to the cache).
-  // The newly created job does not take ownership of |this|.
-  virtual net::URLRequestJob* CreateJobFor(
+  // This creates a URLRequestJob for the |request| wich will read data from the
+  // |intercepted_request_data| structure obtained from |holder| (instead of
+  // going to the network or to the cache).
+  static net::URLRequestJob* CreateJobFor(
+      scoped_refptr<Holder> holder,
       net::URLRequest* request,
-      net::NetworkDelegate* network_delegate) const = 0;
+      net::NetworkDelegate* network_delegate);
 
  protected:
   InterceptedRequestData() {}