Make CryptoResultImpl not to use WeakPtr.

Source/modules/crypto/CryptoResultImpl.cpp

Index: Source/modules/crypto/CryptoResultImpl.cpp
diff --git a/Source/modules/crypto/CryptoResultImpl.cpp b/Source/modules/crypto/CryptoResultImpl.cpp
index 18f45f92f91164f107de07d2b54f144feaee3bcf..9c5161b31c1fa66c2cd7e605b840f90a9775c475 100644
--- a/Source/modules/crypto/CryptoResultImpl.cpp
+++ b/Source/modules/crypto/CryptoResultImpl.cpp
@@ -50,26 +50,24 @@ namespace blink {
 
 class CryptoResultImpl::WeakResolver : public ScriptPromiseResolver {
 public:
-    static WeakPtr<ScriptPromiseResolver> create(ScriptState* scriptState, CryptoResultImpl* result)
+    static PassRefPtr<ScriptPromiseResolver> create(ScriptState* scriptState, CryptoResultImpl* result)
     {
         RefPtr<WeakResolver> p = adoptRef(new WeakResolver(scriptState, result));
         p->suspendIfNeeded();
         p->keepAliveWhilePending();
-        return p->m_weakPtrFactory.createWeakPtr();
+        return p.release();
     }
 
-    virtual ~WeakResolver()
+private:
+    virtual void resolverCleared() override
     {
         m_result->cancel();
     }
 
-private:
     WeakResolver(ScriptState* scriptState, CryptoResultImpl* result)
         : ScriptPromiseResolver(scriptState)
-        , m_weakPtrFactory(this)
         , m_result(result) { }
-    WeakPtrFactory<ScriptPromiseResolver> m_weakPtrFactory;
-    RefPtr<CryptoResultImpl> m_result;
+    CryptoResultImpl* m_result;
 };
 
 ExceptionCode webCryptoErrorToExceptionCode(WebCryptoErrorType errorType)
@@ -102,6 +100,7 @@ ExceptionCode webCryptoErrorToExceptionCode(WebCryptoErrorType errorType)
 
 CryptoResultImpl::~CryptoResultImpl()
 {
+    ASSERT(!m_resolver || m_resolver->stopped());

[tasak, 2014/12/04 08:08:01]

Check whether WeakResoler has been already stopped or not.

If WeakResolver is still alive here, it might use CryptoResultImpl::cancel(),
i.e. heap-use-after-free.

 }
 
 PassRefPtr<CryptoResultImpl> CryptoResultImpl::create(ScriptState* scriptState)
@@ -179,6 +178,7 @@ bool CryptoResultImpl::cancelled() const
 void CryptoResultImpl::cancel()
 {
     releaseStore(&m_cancelled, 1);
+    m_resolver = nullptr;

[tasak, 2014/12/04 08:08:01]

To avoid the following ASSERTION failure, CryptoResultImpl needs to reset
m_resolver in cancel():

ASSERTION FAILED: m_verifier.isSafeToUse()
../../third_party/WebKit/Source/wtf/RefCounted.h(107) : bool
WTF::RefCountedBase::derefBase()
1   0x7fb8fd7ba113
...
19  0x7fb9082867a5 blink::WebCryptoResult::reset()
...
30  0x7fb907391e14
base::SequencedWorkerPool::Inner::ThreadLoop(base::SequencedWorkerPool::Worker*)
31  0x7fb90739175a base::SequencedWorkerPool::Worker::Run()

 }
 
 CryptoResultImpl::CryptoResultImpl(ScriptState* scriptState)