Code: void AppControllerImpl::LaunchHomeUrl(const std::string& suffix,
                                      LaunchHomeUrlCallback callback) {
   if (url_prefix_.empty()) {
     std::move(callback).Run(false, "No URL prefix.");
     return;
  }

  GURL url(url_prefix_ + suffix);
  if (!url.is_valid()) {
    std::move(callback).Run(false, "Invalid URL.");
    return;
  }

  arc::mojom::AppInstance* app_instance =
      arc::ArcServiceManager::Get()
          ? ARC_GET_INSTANCE_FOR_METHOD(
                arc::ArcServiceManager::Get()->arc_bridge_service()->app(),
                LaunchIntent)
          : nullptr;

  if (!app_instance) {
    std::move(callback).Run(false, "ARC bridge not available.");
    return;
  }

  app_instance->LaunchIntent(url.spec(), display::kDefaultDisplayId);
   std::move(callback).Run(true, base::nullopt);
 }

Vulnerability Type: 
CWE ID: CWE-416
Summary: A heap use after free in PDFium in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android allows a remote attacker to potentially exploit heap corruption via crafted PDF files.
Commit Message: Refactor the AppController implementation into a KeyedService.

This is necessary to guarantee that the AppController will not outlive
the AppServiceProxy, which could happen before during Profile destruction.

Bug: 945427
Change-Id: I9e2089799e38d5a70a4a9aa66df5319113e7809e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1542336
Reviewed-by: Michael Giuffrida <michaelpg@chromium.org>
Commit-Queue: Lucas Tenório <ltenorio@chromium.org>
Cr-Commit-Position: refs/heads/master@{#645122}