Code: ExtensionsGuestViewMessageFilter::FrameNavigationHelper::FrameNavigationHelper(
    RenderFrameHost* plugin_rfh,
    int32_t guest_instance_id,
    int32_t element_instance_id,
    bool is_full_page_plugin,
    ExtensionsGuestViewMessageFilter* filter)
    : content::WebContentsObserver(
          content::WebContents::FromRenderFrameHost(plugin_rfh)),
      frame_tree_node_id_(plugin_rfh->GetFrameTreeNodeId()),
      guest_instance_id_(guest_instance_id),
      element_instance_id_(element_instance_id),
      is_full_page_plugin_(is_full_page_plugin),
      filter_(filter),
      parent_site_instance_(plugin_rfh->GetParent()->GetSiteInstance()),
      weak_factory_(this) {
  DCHECK(GetGuestView());
  NavigateToAboutBlank();
  base::PostDelayedTaskWithTraits(
      FROM_HERE, {BrowserThread::UI},
      base::BindOnce(&ExtensionsGuestViewMessageFilter::FrameNavigationHelper::
                         CancelPendingTask,
                     weak_factory_.GetWeakPtr()),
      base::TimeDelta::FromMilliseconds(kAttachFailureDelayMS));
}

Vulnerability Type: 
CWE ID: CWE-362
Summary: Data race in extensions guest view in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Commit Message: [GuestView] - Introduce MimeHandlerViewAttachHelper

This CL is for the most part a mechanical change which extracts almost
all the frame-based MimeHandlerView code out of
ExtensionsGuestViewMessageFilter. This change both removes the current
clutter form EGVMF as well as fixesa race introduced when the
frame-based logic was added to EGVMF. The reason for the race was that
EGVMF is destroyed on IO thread but all the access to it (for
frame-based MHV) are from UI.

TBR=avi@chromium.org,lazyboy@chromium.org

Bug: 659750, 896679, 911161, 918861
Change-Id: I6474b870e4d56daa68be03637bb633665d9f9dda
Reviewed-on: https://chromium-review.googlesource.com/c/1401451
Commit-Queue: Ehsan Karamad <ekaramad@chromium.org>
Reviewed-by: James MacLean <wjmaclean@chromium.org>
Reviewed-by: Ehsan Karamad <ekaramad@chromium.org>
Cr-Commit-Position: refs/heads/master@{#621155}