Code:    static void GetLoadTimes(const v8::FunctionCallbackInfo<v8::Value>& args) {
     WebLocalFrame* frame = WebLocalFrame::frameForCurrentContext();
     if (!frame) {
      args.GetReturnValue().SetNull();
       return;
     }
     WebDataSource* data_source = frame->dataSource();
     if (!data_source) {
      args.GetReturnValue().SetNull();
       return;
     }
     DocumentState* document_state = DocumentState::FromDataSource(data_source);
     if (!document_state) {
      args.GetReturnValue().SetNull();
       return;
     }
     double request_time = document_state->request_time().ToDoubleT();
    double start_load_time = document_state->start_load_time().ToDoubleT();
    double commit_load_time = document_state->commit_load_time().ToDoubleT();
    double finish_document_load_time =
        document_state->finish_document_load_time().ToDoubleT();
    double finish_load_time = document_state->finish_load_time().ToDoubleT();
    double first_paint_time = document_state->first_paint_time().ToDoubleT();
    double first_paint_after_load_time =
        document_state->first_paint_after_load_time().ToDoubleT();
    std::string navigation_type =
        GetNavigationType(data_source->navigationType());
    bool was_fetched_via_spdy = document_state->was_fetched_via_spdy();
    bool was_npn_negotiated = document_state->was_npn_negotiated();
    std::string npn_negotiated_protocol =
        document_state->npn_negotiated_protocol();
    bool was_alternate_protocol_available =
        document_state->was_alternate_protocol_available();
    std::string connection_info = net::HttpResponseInfo::ConnectionInfoToString(
        document_state->connection_info());
     v8::Isolate* isolate = args.GetIsolate();
     v8::Local<v8::Object> load_times = v8::Object::New(isolate);
    load_times->Set(v8::String::NewFromUtf8(isolate, "requestTime"),
                    v8::Number::New(isolate, request_time));
    load_times->Set(v8::String::NewFromUtf8(isolate, "startLoadTime"),
                    v8::Number::New(isolate, start_load_time));
    load_times->Set(v8::String::NewFromUtf8(isolate, "commitLoadTime"),
                    v8::Number::New(isolate, commit_load_time));
    load_times->Set(v8::String::NewFromUtf8(isolate, "finishDocumentLoadTime"),
                    v8::Number::New(isolate, finish_document_load_time));
    load_times->Set(v8::String::NewFromUtf8(isolate, "finishLoadTime"),
                    v8::Number::New(isolate, finish_load_time));
    load_times->Set(v8::String::NewFromUtf8(isolate, "firstPaintTime"),
                    v8::Number::New(isolate, first_paint_time));
    load_times->Set(v8::String::NewFromUtf8(isolate, "firstPaintAfterLoadTime"),
                    v8::Number::New(isolate, first_paint_after_load_time));
    load_times->Set(v8::String::NewFromUtf8(isolate, "navigationType"),
                    v8::String::NewFromUtf8(isolate, navigation_type.c_str()));
    load_times->Set(v8::String::NewFromUtf8(isolate, "wasFetchedViaSpdy"),
                    v8::Boolean::New(isolate, was_fetched_via_spdy));
    load_times->Set(v8::String::NewFromUtf8(isolate, "wasNpnNegotiated"),
                    v8::Boolean::New(isolate, was_npn_negotiated));
    load_times->Set(
        v8::String::NewFromUtf8(isolate, "npnNegotiatedProtocol"),
        v8::String::NewFromUtf8(isolate, npn_negotiated_protocol.c_str()));
    load_times->Set(
        v8::String::NewFromUtf8(isolate, "wasAlternateProtocolAvailable"),
        v8::Boolean::New(isolate, was_alternate_protocol_available));
    load_times->Set(v8::String::NewFromUtf8(isolate, "connectionInfo"),
                    v8::String::NewFromUtf8(isolate, connection_info.c_str()));
     args.GetReturnValue().Set(load_times);
   }

Vulnerability Type: DoS 
CWE ID: 
Summary: Use-after-free vulnerability in the GetLoadTimes function in renderer/loadtimes_extension_bindings.cc in the Extensions implementation in Google Chrome before 49.0.2623.108 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code.
Commit Message: Cache csi info before passing it to JS setters.

JS setters invalidate the pointers frame, data_source and document_state.

BUG=590455

Review URL: https://codereview.chromium.org/1751553002

Cr-Commit-Position: refs/heads/master@{#379047}