angler-fishThe Vulnerability History Project

IndexedDB: Protect against use-after-free in ChainedBlobWriter.

      This is a speculative fix for a heap user-after-free bug. Was unable
to verify using a Windows SyzyASan build. The theory is that if Abort()
was called before ChainedBlobWriterImpl::WriteNextFile() could set
waiting_for_callback_ then the ReportWriteCompletion() would never know
that it was aborted and attempt to use it's dangling raw pointer to a
deleted IndexedDBBackingStore instance.

Also in this change is the elimination of the redundant aborted_
member variable.

BUG=472614

Review URL: https://codereview.chromium.org/1060613002

Cr-Commit-Position: refs/heads/master@{#326597}
    
commit 29777a8ee0f45b8160ec004e74013d5b62b6828a
+12 -9
expand_less