Fix potential use-after-free in ephemeral_app_launcher.cc and webstore_install_with_prompt.cc

This CL fixes use-after-frees which occur if the app list is dismissed quickly
after an install is initiated. The use-after-free is easy to reproduce with a
slow internet connection.

BUG=422814
TEST=None

Review URL: https://codereview.chromium.org/711633002

Cr-Commit-Position: refs/heads/master@{#304071}

4 files changed, 22 insertions, 4 deletions

diff --git a/chrome/browser/apps/ephemeral_app_launcher.cc b/chrome/browser/apps/ephemeral_app_launcher.cc
index 90f423f..a1f516b 100644
--- a/chrome/browser/apps/ephemeral_app_launcher.cc
+++ b/chrome/browser/apps/ephemeral_app_launcher.cc
@@ -13,6 +13,7 @@
 #include "chrome/browser/ui/browser_navigator.h"
 #include "chrome/browser/ui/extensions/application_launch.h"
 #include "chrome/browser/ui/extensions/extension_enable_flow.h"
+#include "chrome/browser/ui/native_window_tracker.h"
 #include "chrome/browser/ui/scoped_tabbed_browser_displayer.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/extensions/manifest_handlers/app_launch_info.h"
@@ -163,6 +164,8 @@ EphemeralAppLauncher::EphemeralAppLauncher(const std::string& webstore_item_id,
       parent_window_(parent_window),
       dummy_web_contents_(
           WebContents::Create(WebContents::CreateParams(profile))) {
+   if (parent_window_)
+     parent_window_tracker_ = NativeWindowTracker::Create(parent_window);
 }
 
 EphemeralAppLauncher::EphemeralAppLauncher(const std::string& webstore_item_id,
@@ -353,7 +356,14 @@ void EphemeralAppLauncher::InitInstallData(
 }
 
 bool EphemeralAppLauncher::CheckRequestorAlive() const {
-  return dummy_web_contents_.get() != NULL || web_contents() != NULL;
+  if (!parent_window_) {
+    // Assume the requestor is always alive if |parent_window_| is null.
+    return true;
+  }
+
+  return (web_contents() != nullptr ||
+          (parent_window_tracker_ &&
+              !parent_window_tracker_->WasNativeWindowClosed()));
 }
 
 const GURL& EphemeralAppLauncher::GetRequestorURL() const {
diff --git a/chrome/browser/apps/ephemeral_app_launcher.h b/chrome/browser/apps/ephemeral_app_launcher.h
index 04927b5..39a6c18 100644
--- a/chrome/browser/apps/ephemeral_app_launcher.h
+++ b/chrome/browser/apps/ephemeral_app_launcher.h
@@ -16,6 +16,7 @@
 #include "content/public/browser/web_contents_observer.h"
 
 class ExtensionEnableFlow;
+class NativeWindowTracker;
 class Profile;
 
 namespace content {
@@ -143,6 +144,7 @@ class EphemeralAppLauncher : public extensions::WebstoreStandaloneInstaller,
   LaunchCallback launch_callback_;
 
   gfx::NativeWindow parent_window_;
+  scoped_ptr<NativeWindowTracker> parent_window_tracker_;
   scoped_ptr<content::WebContents> dummy_web_contents_;
 
   scoped_ptr<ExtensionEnableFlow> extension_enable_flow_;
diff --git a/chrome/browser/extensions/webstore_install_with_prompt.cc b/chrome/browser/extensions/webstore_install_with_prompt.cc
index f66acc1..b0ddf40 100644
--- a/chrome/browser/extensions/webstore_install_with_prompt.cc
+++ b/chrome/browser/extensions/webstore_install_with_prompt.cc
@@ -34,7 +34,8 @@ WebstoreInstallWithPrompt::WebstoreInstallWithPrompt(
       dummy_web_contents_(
           WebContents::Create(WebContents::CreateParams(profile))),
       parent_window_(parent_window) {
-  DCHECK(parent_window);
+  if (parent_window_)
+    parent_window_tracker_ = NativeWindowTracker::Create(parent_window);
   set_install_source(WebstoreInstaller::INSTALL_SOURCE_OTHER);
 }
 
@@ -42,8 +43,11 @@ WebstoreInstallWithPrompt::~WebstoreInstallWithPrompt() {
 }
 
 bool WebstoreInstallWithPrompt::CheckRequestorAlive() const {
-  // Assume the requestor is always alive.
-  return true;
+  if (!parent_window_) {
+    // Assume the requestor is always alive if |parent_window_| is null.
+    return true;
+  }
+  return !parent_window_tracker_->WasNativeWindowClosed();
 }
 
 const GURL& WebstoreInstallWithPrompt::GetRequestorURL() const {
diff --git a/chrome/browser/extensions/webstore_install_with_prompt.h b/chrome/browser/extensions/webstore_install_with_prompt.h
index 189ec97..7166d58 100644
--- a/chrome/browser/extensions/webstore_install_with_prompt.h
+++ b/chrome/browser/extensions/webstore_install_with_prompt.h
@@ -8,6 +8,7 @@
 #include "base/basictypes.h"
 #include "base/memory/scoped_ptr.h"
 #include "chrome/browser/extensions/webstore_standalone_installer.h"
+#include "chrome/browser/ui/native_window_tracker.h"
 #include "ui/gfx/native_widget_types.h"
 #include "url/gurl.h"
 
@@ -71,6 +72,7 @@ class WebstoreInstallWithPrompt : public WebstoreStandaloneInstaller {
   scoped_ptr<content::WebContents> dummy_web_contents_;
 
   gfx::NativeWindow parent_window_;
+  scoped_ptr<NativeWindowTracker> parent_window_tracker_;
 
   DISALLOW_COPY_AND_ASSIGN(WebstoreInstallWithPrompt);
 };