Code: void PaymentRequest::UpdateWith(mojom::PaymentDetailsPtr details) {
   std::string error;
   if (!ValidatePaymentDetails(ConvertPaymentDetails(details), &error)) {
    LOG(ERROR) << error;
     OnConnectionTerminated();
     return;
   }
 
   if (details->shipping_address_errors &&
       !PaymentsValidators::IsValidAddressErrorsFormat(
           details->shipping_address_errors, &error)) {
    DLOG(ERROR) << error;
     OnConnectionTerminated();
     return;
   }
 
   if (!details->total) {
    LOG(ERROR) << "Missing total";
     OnConnectionTerminated();
     return;
   }

  spec_->UpdateWith(std::move(details));
 }

Vulnerability Type: 
CWE ID: CWE-189
Summary: Incorrect handling of negative zero in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page.
Commit Message: [Payment Request][Desktop] Prevent use after free.

Before this patch, a compromised renderer on desktop could make IPC
methods into Payment Request in an unexpected ordering and cause use
after free in the browser.

This patch will disconnect the IPC pipes if:
 - Init() is called more than once.
 - Any other method is called before Init().
 - Show() is called more than once.
 - Retry(), UpdateWith(), NoupdatedPaymentDetails(), Abort(), or
   Complete() are called before Show().

This patch re-orders the IPC methods in payment_request.cc to match the
order in payment_request.h, which eases verifying correctness of their
error handling.

This patch prints more errors to the developer console, if available, to
improve debuggability by web developers, who rarely check where LOG
prints.

After this patch, unexpected ordering of calls into the Payment Request
IPC from the renderer to the browser on desktop will print an error in
the developer console and disconnect the IPC pipes. The binary might
increase slightly in size because more logs are included in the release
version instead of being stripped at compile time.

Bug: 912947
Change-Id: Iac2131181c64cd49b4e5ec99f4b4a8ae5d8df57a
Reviewed-on: https://chromium-review.googlesource.com/c/1370198
Reviewed-by: anthonyvd <anthonyvd@chromium.org>
Commit-Queue: Rouslan Solomakhin <rouslan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#616822}