Fix crash in AutoFill

It is possible that the AutoFillManager has been deleted before the
URLFetcherProxy::DoComplete callback runs. In this case, we will crash.

Store the pending callback in a map and remove it if the URLFetcherProxy
gets deleted.

Bug: 3197857
Change-Id: I63821a06ff91953426a84a00f80d0ad4c553be3d

2 files changed, 39 insertions, 1 deletions

diff --git a/android/autofill/url_fetcher_proxy.cc b/android/autofill/url_fetcher_proxy.cc
new file mode 100644
index 0000000..58a4c6c
--- /dev/null
+++ b/android/autofill/url_fetcher_proxy.cc
@@ -0,0 +1,32 @@
+/*
+ * Copyright 2010, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "android/autofill/url_fetcher_proxy.h"
+
+// TODO: Move the implementation of URLFetcherProxy here from the header
+// file.
+
+std::map<URLFetcherProxy*, bool> URLFetcherProxy::pending_callbacks_;
+
diff --git a/android/autofill/url_fetcher_proxy.h b/android/autofill/url_fetcher_proxy.h
index 098129b..c2bc77e 100644
--- a/android/autofill/url_fetcher_proxy.h
+++ b/android/autofill/url_fetcher_proxy.h
@@ -80,6 +80,7 @@ public:
 
   virtual ~URLFetcherProxy()
   {
+      pending_callbacks_.erase(this);
   }
 
   virtual void set_automatically_retry_on_5xx(bool retry)
@@ -115,6 +116,7 @@ public:
     response_code_ = response_code;
     cookies_ = cookies;
     data_ = data;
+    pending_callbacks_[this] = true;
     MainThreadProxy::CallOnMainThread(DoComplete, this);
   }
 
@@ -138,7 +140,9 @@ private:
   static void DoComplete(void* context)
   {
     URLFetcherProxy* that = static_cast<URLFetcherProxy*>(context);
-    that->DoCompleteImpl();
+    if (pending_callbacks_[that]) {
+      that->DoCompleteImpl();
+    }
   }
 
   void DoCompleteImpl()
@@ -159,6 +163,8 @@ private:
   ResponseCookies cookies_;
   std::string data_;
 
+  static std::map<URLFetcherProxy*, bool> pending_callbacks_;
+
   DISALLOW_EVIL_CONSTRUCTORS(URLFetcherProxy);
 };