Code: int WebContentsImpl::DownloadImage(
    const GURL& url,
    bool is_favicon,
    uint32_t max_bitmap_size,
    bool bypass_cache,
    const WebContents::ImageDownloadCallback& callback) {
  DCHECK_CURRENTLY_ON(BrowserThread::UI);
  static int next_image_download_id = 0;
  const image_downloader::ImageDownloaderPtr& mojo_image_downloader =
      GetMainFrame()->GetMojoImageDownloader();
  const int download_id = ++next_image_download_id;
  if (!mojo_image_downloader) {
     BrowserThread::PostTask(
         BrowserThread::UI, FROM_HERE,
        base::Bind(&WebContents::ImageDownloadCallback::Run,
                   base::Owned(new ImageDownloadCallback(callback)),
                   download_id, 400, url, std::vector<SkBitmap>(),
                   std::vector<gfx::Size>()));
     return download_id;
   }
 
  image_downloader::DownloadRequestPtr req =
      image_downloader::DownloadRequest::New();

  req->url = mojo::String::From(url);
  req->is_favicon = is_favicon;
  req->max_bitmap_size = max_bitmap_size;
   req->bypass_cache = bypass_cache;
 
   mojo_image_downloader->DownloadImage(
      std::move(req),
      base::Bind(&DidDownloadImage, callback, download_id, url));
   return download_id;
 }

Vulnerability Type: DoS 
CWE ID: 
Summary: Use-after-free vulnerability in content/browser/web_contents/web_contents_impl.cc in Google Chrome before 49.0.2623.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an image download after a certain data structure is deleted, as demonstrated by a favicon.ico download.
Commit Message: Don't call WebContents::DownloadImage() callback if the WebContents were deleted

BUG=583718

Review URL: https://codereview.chromium.org/1685343004

Cr-Commit-Position: refs/heads/master@{#375700}