Fix use-after-free and crash in extension install from web intents
WebIntentPickerController is a WebstoreInstaller::Delegate, but can be deleted
before the WebstoreInstaller finishes installing the extension, leading to a
use-after-free and crash. We're seeing this crash on Chrome OS, perhaps due
to timing differences in extension install.
In other places in the code this lifetime issue is addressed by adding
reference counting to the class implementing WebstoreInstall::Delegate and
manually using AddRef() and Release() around the extension installation,
but in this case the lifetime of WebIntentPickerController is controlled by
WebContents.
Fix by manually invalidate the WebstoreInstaller's delegate_ when the
WebIntentPickerController goes away.
BUG=157767
TEST=added to browser_tests WebIntentPickerControllerBrowserTest, also
manually install extension from web intents on imagemator.com
Review URL: https://chromiumcodereview.appspot.com/11315013
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@164812 0039d316-1c4b-4281-b951-d872f2087c98
diff --git a/chrome/browser/extensions/webstore_installer.h b/chrome/browser/extensions/webstore_installer.h
index 64cef21..b263f81c 100644
--- a/chrome/browser/extensions/webstore_installer.h
+++ b/chrome/browser/extensions/webstore_installer.h
@@ -136,6 +136,10 @@
const content::NotificationSource& source,
const content::NotificationDetails& details) OVERRIDE;
+ // Removes the reference to the delegate passed in the constructor. Used when
+ // the delegate object must be deleted before this object.
+ void InvalidateDelegate();
+
// Instead of using the default download directory, use |directory| instead.
// This does *not* transfer ownership of |directory|.
static void SetDownloadDirectoryForTests(FilePath* directory);
