tree 9d68743580a54e6228089953dde53bc2d336d93b
parent 91e7787fa5338fc0eeb6cbf0c504d4dc187b16ce
author Martin Kosiba <mkosiba@google.com> 1383933328 +0000
committer Martin Kosiba <mkosiba@google.com> 1384169711 +0000

[android_webview] Fix UAF in request interception code.

Cherry-pick http://crrev.com/61653004

> It was possible for any of the tasks posted by the
> AndroidStreamReaderURLRequestJob to access the InterceptedRequestData
> after the URLRequest owning that data structure was deleted
> The fix is to make the newly created job's Delgate own the
> InterceptedRequestData since the AndroidStreamReaderURLRequestJob takes
> care to not delete the Delegate before all async tasks have finished.
>
> BUG=internal b/11520856
> TEST=AndroidWebViewTest
> Android-only CL, trybots happy.
> NOTRY=true
>
> Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=233937

BUG: 11520856
Change-Id: I2063f9e13aecd24091d5f5d9361473b3656fd752