Fix crash in AutoFill

We recently changed WebKit to use one URLRequestContext per WebView.
However AutoFill did not get migrated to the new system and so
we have observed crashes due to a dangling pointer. We have one
AutoFill object per WebView and hence one Profile object per webview.
we access the URLRequestContext through the Profile so inject the
correct context in when the AutoFill object is created.

Needs a change in external/webkit, see
Iace23ae8c0240f0134894c12d2f7281161aa6150

Bug: 3291654

Change-Id: I004ab7ac9c6a72be1b62aa8e44322b97a371c136

5 files changed, 18 insertions, 32 deletions

diff --git a/android/autofill/android_url_request_context_getter.cc b/android/autofill/android_url_request_context_getter.cc
index 5038cd6..4dcf971 100644
--- a/android/autofill/android_url_request_context_getter.cc
+++ b/android/autofill/android_url_request_context_getter.cc
@@ -26,11 +26,9 @@
 
 #include "android_url_request_context_getter.h"
 
-scoped_refptr<AndroidURLRequestContextGetter> AndroidURLRequestContextGetter::instance_ = NULL;
-
 URLRequestContext* AndroidURLRequestContextGetter::GetURLRequestContext()
 {
-  return context_;
+  return context_.get();
 }
 
 scoped_refptr<base::MessageLoopProxy> AndroidURLRequestContextGetter::GetIOMessageLoopProxy() const
@@ -49,14 +47,3 @@ scoped_refptr<base::MessageLoopProxy> AndroidURLRequestContextGetter::GetIOMessa
   return io_thread_->message_loop_proxy();
 }
 
-AndroidURLRequestContextGetter* AndroidURLRequestContextGetter::Get()
-{
-  if (!instance_)
-    instance_ = new AndroidURLRequestContextGetter;
-  return instance_;
-}
-
-void AndroidURLRequestContextGetter::SetURLRequestContext(URLRequestContext* context)
-{
-  context_ = context;
-}
diff --git a/android/autofill/android_url_request_context_getter.h b/android/autofill/android_url_request_context_getter.h
index 81b2f56..80e9513 100644
--- a/android/autofill/android_url_request_context_getter.h
+++ b/android/autofill/android_url_request_context_getter.h
@@ -33,8 +33,11 @@
 
 class AndroidURLRequestContextGetter : public URLRequestContextGetter {
 public:
-  AndroidURLRequestContextGetter()
-    : context_(0), io_thread_(0) { };
+  AndroidURLRequestContextGetter(URLRequestContext* context, base::Thread* ioThread)
+    : context_(context)
+    , io_thread_(ioThread)
+  {
+  }
 
   virtual ~AndroidURLRequestContextGetter() { }
 
@@ -42,14 +45,8 @@ public:
   virtual URLRequestContext* GetURLRequestContext();
   virtual scoped_refptr<base::MessageLoopProxy> GetIOMessageLoopProxy() const;
 
-  static AndroidURLRequestContextGetter* Get();
-
-  void SetURLRequestContext(URLRequestContext*);
-  void SetIOThread(base::Thread* io_thread) { io_thread_ = io_thread; }
-
 private:
-  static scoped_refptr<AndroidURLRequestContextGetter> instance_;
-  URLRequestContext* context_;
+  scoped_refptr<URLRequestContext> context_;
   mutable base::Thread* io_thread_;
 };
 
diff --git a/android/autofill/profile_android.cc b/android/autofill/profile_android.cc
index 4ea1b23..3cc51f1 100644
--- a/android/autofill/profile_android.cc
+++ b/android/autofill/profile_android.cc
@@ -60,11 +60,10 @@ PrefService* ProfileImplAndroid::GetPrefs() {
   return preferences_.get();
 }
 
-Profile* Profile::CreateProfile(const FilePath& path) {
-  return new ProfileImplAndroid(path);
+URLRequestContextGetter* ProfileImplAndroid::GetRequestContext() {
+  return url_request_context_getter_.get();
 }
 
-URLRequestContextGetter* Profile::GetDefaultRequestContext()
-{
-  return AndroidURLRequestContextGetter::Get();
+Profile* Profile::CreateProfile(const FilePath& path) {
+    return new ProfileImplAndroid(path);
 }
diff --git a/android/autofill/profile_android.h b/android/autofill/profile_android.h
index 1117636..b7a9545 100644
--- a/android/autofill/profile_android.h
+++ b/android/autofill/profile_android.h
@@ -112,11 +112,14 @@ class ProfileImplAndroid : public Profile {
  public:
   virtual ~ProfileImplAndroid();
 
+  void SetRequestContext(URLRequestContextGetter* context) { url_request_context_getter_ = context; }
+
   // Profile implementation.
   virtual Profile* GetOriginalProfile();
   virtual PersonalDataManager* GetPersonalDataManager();
   virtual PrefService* GetPrefs();
   virtual FilePath GetPath() { return path_; }
+  virtual URLRequestContextGetter* GetRequestContext();
 
   // Functions from Profile that we don't need on Android for AutoFill.
   virtual ProfileId GetRuntimeId() { NOTREACHED(); return 0; }
@@ -154,7 +157,6 @@ class ProfileImplAndroid : public Profile {
   virtual const Extension* GetTheme() { NOTREACHED(); return NULL; }
   virtual BrowserThemeProvider* GetThemeProvider()  { NOTREACHED(); return NULL; }
   virtual bool HasCreatedDownloadManager() const { NOTREACHED(); return false; }
-  virtual URLRequestContextGetter* GetRequestContext()  { NOTREACHED(); return NULL; }
   virtual URLRequestContextGetter* GetRequestContextForMedia()  { NOTREACHED(); return NULL; }
   virtual URLRequestContextGetter* GetRequestContextForExtensions()  { NOTREACHED(); return NULL; }
   virtual void RegisterExtensionWithRequestContexts(const Extension* extension) { NOTREACHED(); }
@@ -201,7 +203,6 @@ class ProfileImplAndroid : public Profile {
   virtual BrowserSignin* GetBrowserSignin() { NOTREACHED(); return NULL; }
   virtual bool HasProfileSyncService() const { NOTREACHED(); return false; }
 
-
  private:
   friend class Profile;
 
@@ -225,6 +226,7 @@ class ProfileImplAndroid : public Profile {
   FilePath path_;
   scoped_ptr<PrefService> preferences_;
   scoped_refptr<PersonalDataManager> personal_data_;
+  scoped_refptr<URLRequestContextGetter> url_request_context_getter_;
 
   DISALLOW_COPY_AND_ASSIGN(ProfileImplAndroid);
 };
diff --git a/android/autofill/url_fetcher_proxy.h b/android/autofill/url_fetcher_proxy.h
index 415b730..19cabf3 100644
--- a/android/autofill/url_fetcher_proxy.h
+++ b/android/autofill/url_fetcher_proxy.h
@@ -98,7 +98,8 @@ public:
 
   virtual void Start()
   {
-    URLRequestContextGetter* con =  Profile::GetDefaultRequestContext();
+    scoped_refptr<URLRequestContextGetter> con = request_context();
+    CHECK(con.get()) << "No URLRequestContextGetter!";
     scoped_refptr<base::MessageLoopProxy> mlp = con->GetIOMessageLoopProxy();
     // TODO: See the template specialisation at the top of the file. Can we use
     // an alternative to RunnableMethod that doesn't expect a ref counted object?
@@ -134,7 +135,7 @@ private:
     real_fetcher_->set_automatically_retry_on_5xx(retry_);
     // We expect set_upload_data() to have been called on this object.
     real_fetcher_->set_upload_data(upload_content_type_, upload_content_);
-    real_fetcher_->set_request_context(ProfileImplAndroid::GetDefaultRequestContext());
+    real_fetcher_->set_request_context(request_context());
     real_fetcher_->Start();
   };