Fix use-after-free in WebSocketHost::AddChannel()

Fix heap-use-after-free in WebSocketHost::AddChannel()

WebSocketHost can be deleted in channel_->SendAddChannelRequest() and this
caused heap-use-after-free when |pending_flow_control_quota_| is accessed in
WebSocketHost::AddChannel().
This CL fixes it by posting OnFlowControl() with WeakPtr instead of calling
SendFlowControl() directly in WebSocketHost::AddChannel().

BUG=466335
Committed: https://crrev.com/d3a1d188162e45f75c87a218a70681c5d92139a8
Cr-Commit-Position: refs/heads/master@{#320260}

[hiroshige, 2015-03-12 08:08:44]

hiroshige@chromium.org changed reviewers:
+ ricea@chromium.org

[hiroshige, 2015-03-12 08:11:45]

PTAL.

Probably this case
(https://code.google.com/p/chromium/codesearch#chromium/src/net/websockets/web...
is executed) doesn't occur with Blink, but seems to occur on clusterfuzz.

[Adam Rice, 2015-03-12 08:27:24]

I'm really sorry I didn't catch this problem.

Please write a regression test, either in this CL or in a separate one.

https://codereview.chromium.org/998173003/diff/20001/content/browser/renderer...
File content/browser/renderer_host/websocket_host.cc (right):

https://codereview.chromium.org/998173003/diff/20001/content/browser/renderer...
content/browser/renderer_host/websocket_host.cc:370: // |this| might be deleted
here.
Nit: "might be deleted" is slightly ambiguous; I would prefer the wording "may
have been deleted".

Also in AddChannel() below.

https://codereview.chromium.org/998173003/diff/20001/content/browser/renderer...
content/browser/renderer_host/websocket_host.cc:392: //
channel_->SendFlowControl(pending_flow_control_quota_) should be called
s/should/must/

[hiroshige, 2015-03-12 08:50:19]

Preparing a test in another CL.

https://codereview.chromium.org/998173003/diff/20001/content/browser/renderer...
File content/browser/renderer_host/websocket_host.cc (right):

https://codereview.chromium.org/998173003/diff/20001/content/browser/renderer...
content/browser/renderer_host/websocket_host.cc:370: // |this| might be deleted
here.
On 2015/03/12 08:27:24, Adam Rice wrote:
> Nit: "might be deleted" is slightly ambiguous; I would prefer the wording "may
> have been deleted".
> 
> Also in AddChannel() below.

Done.

https://codereview.chromium.org/998173003/diff/20001/content/browser/renderer...
content/browser/renderer_host/websocket_host.cc:392: //
channel_->SendFlowControl(pending_flow_control_quota_) should be called
On 2015/03/12 08:27:24, Adam Rice wrote:
> s/should/must/

Done.

[Adam Rice, 2015-03-12 08:55:47]

lgtm

[hiroshige, 2015-03-12 09:03:49]

The CQ bit was checked by hiroshige@chromium.org

[commit-bot: I haz the power, 2015-03-12 09:04:00]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/998173003/40001

[commit-bot: I haz the power, 2015-03-12 10:11:39]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2015-03-12 10:12:12]

Patchset 3 (id:??) landed as
https://crrev.com/d3a1d188162e45f75c87a218a70681c5d92139a8
Cr-Commit-Position: refs/heads/master@{#320260}

[hiroshige, 2015-03-16 10:29:07]

A revert of this CL (patchset #3 id:40001) has been created in
https://codereview.chromium.org/1006293002/ by hiroshige@chromium.org.

The reason for reverting is: Speculatively revert for https://crbug.com/467471.