Code: void ExtensionsGuestViewMessageFilter::ResumeAttachOrDestroy(
    int32_t element_instance_id,
    int32_t plugin_frame_routing_id) {
  auto it = frame_navigation_helpers_.find(element_instance_id);
  if (it == frame_navigation_helpers_.end()) {
    return;
  }
  auto* plugin_rfh = content::RenderFrameHost::FromID(render_process_id_,
                                                      plugin_frame_routing_id);
  auto* helper = it->second.get();
  auto* guest_view = helper->GetGuestView();
  if (!guest_view)
    return;
 
  if (plugin_rfh) {
    DCHECK(
        guest_view->web_contents()->CanAttachToOuterContentsFrame(plugin_rfh));
    guest_view->AttachToOuterWebContentsFrame(plugin_rfh, element_instance_id,
                                              helper->is_full_page_plugin());
  } else {
    guest_view->GetEmbedderFrame()->Send(
        new ExtensionsGuestViewMsg_DestroyFrameContainer(element_instance_id));
    guest_view->Destroy(true);
  }
  frame_navigation_helpers_.erase(element_instance_id);
 }

Vulnerability Type: 
CWE ID: CWE-362
Summary: Data race in extensions guest view in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Commit Message: [GuestView] - Introduce MimeHandlerViewAttachHelper

This CL is for the most part a mechanical change which extracts almost
all the frame-based MimeHandlerView code out of
ExtensionsGuestViewMessageFilter. This change both removes the current
clutter form EGVMF as well as fixesa race introduced when the
frame-based logic was added to EGVMF. The reason for the race was that
EGVMF is destroyed on IO thread but all the access to it (for
frame-based MHV) are from UI.

TBR=avi@chromium.org,lazyboy@chromium.org

Bug: 659750, 896679, 911161, 918861
Change-Id: I6474b870e4d56daa68be03637bb633665d9f9dda
Reviewed-on: https://chromium-review.googlesource.com/c/1401451
Commit-Queue: Ehsan Karamad <ekaramad@chromium.org>
Reviewed-by: James MacLean <wjmaclean@chromium.org>
Reviewed-by: Ehsan Karamad <ekaramad@chromium.org>
Cr-Commit-Position: refs/heads/master@{#621155}