Code:  void IOHandler::Read(
    const std::string& handle,
    Maybe<int> offset,
    Maybe<int> max_size,
    std::unique_ptr<ReadCallback> callback) {
  static const size_t kDefaultChunkSize = 10 * 1024 * 1024;
  static const char kBlobPrefix[] = "blob:";
 
   scoped_refptr<DevToolsIOContext::ROStream> stream =
       io_context_->GetByHandle(handle);
  if (!stream && process_host_ &&
       StartsWith(handle, kBlobPrefix, base::CompareCase::SENSITIVE)) {
    BrowserContext* browser_context = process_host_->GetBrowserContext();
     ChromeBlobStorageContext* blob_context =
        ChromeBlobStorageContext::GetFor(browser_context);
    StoragePartition* storage_partition = process_host_->GetStoragePartition();
     std::string uuid = handle.substr(strlen(kBlobPrefix));
     stream =
        io_context_->OpenBlob(blob_context, storage_partition, handle, uuid);
   }
 
   if (!stream) {
    callback->sendFailure(Response::InvalidParams("Invalid stream handle"));
    return;
  }
  stream->Read(
      offset.fromMaybe(-1), max_size.fromMaybe(kDefaultChunkSize),
      base::BindOnce(&IOHandler::ReadComplete, weak_factory_.GetWeakPtr(),
                     base::Passed(std::move(callback))));
}

Vulnerability Type: Exec Code 
CWE ID: CWE-20
Summary: An object lifetime issue in the developer tools network handler in Google Chrome prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via a crafted HTML page.
Commit Message: DevTools: speculative fix for crash in NetworkHandler::Disable

This keeps BrowserContext* and StoragePartition* instead of
RenderProcessHost* in an attemp to resolve UAF of RenderProcessHost
upon closure of DevTools front-end.

Bug: 801117, 783067, 780694
Change-Id: I6c2cca60cc0c29f0949d189cf918769059f80c1b
Reviewed-on: https://chromium-review.googlesource.com/876657
Commit-Queue: Andrey Kosyakov <caseq@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#531157}