Code: void WebUIExtension::Send(gin::Arguments* args) {
  blink::WebLocalFrame* frame;
  RenderFrame* render_frame;
  if (!ShouldRespondToRequest(&frame, &render_frame))
    return;

  std::string message;
  if (!args->GetNext(&message)) {
    args->ThrowError();
    return;
  }

  if (base::EndsWith(message, "RequiringGesture",
                     base::CompareCase::SENSITIVE) &&
      !blink::WebUserGestureIndicator::IsProcessingUserGesture(frame)) {
    NOTREACHED();
    return;
  }

  std::unique_ptr<base::ListValue> content;
  if (args->PeekNext().IsEmpty() || args->PeekNext()->IsUndefined()) {
    content.reset(new base::ListValue());
  } else {
    v8::Local<v8::Object> obj;
    if (!args->GetNext(&obj)) {
      args->ThrowError();
      return;
    }

     content = base::ListValue::From(V8ValueConverter::Create()->FromV8Value(
         obj, frame->MainWorldScriptContext()));
     DCHECK(content);
   }
 
  render_frame->Send(new FrameHostMsg_WebUISend(render_frame->GetRoutingID(),
                                                frame->GetDocument().Url(),
                                                message, *content));
}

Vulnerability Type: 
CWE ID: CWE-416
Summary: Use after free in WebUI in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension.
Commit Message: Validate frame after conversion in chrome.send

BUG=797511
TEST=Manually, see https://crbug.com/797511#c1

Change-Id: Ib1a99db4d7648fb1325eb6d7af4ef111d6dda4cb
Reviewed-on: https://chromium-review.googlesource.com/844076
Commit-Queue: Rob Wu <rob@robwu.nl>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#526197}