Code:  void ImageCapture::ResolveWithMediaTrackConstraints(
    MediaTrackConstraints constraints,
     ScriptPromiseResolver* resolver) {
   DCHECK(resolver);
   resolver->Resolve(constraints);
}

Vulnerability Type: 
CWE ID: CWE-416
Summary: A use after free in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka an ImageCapture NULL pointer dereference.
Commit Message: Convert MediaTrackConstraints to a ScriptValue

IDLDictionaries such as MediaTrackConstraints should not be stored on
the heap which would happen when binding one as a parameter to a
callback. This change converts the object to a ScriptValue ahead of
time. This is fine because the value will be passed to a
ScriptPromiseResolver that will converted it to a V8 value if it
isn't already.

Bug: 759457
Change-Id: I3009a0f7711cc264aeaae07a36c18a6db8c915c8
Reviewed-on: https://chromium-review.googlesource.com/701358
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Reilly Grant <reillyg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#507177}