Code: void SaveCardBubbleControllerImpl::ShowBubbleForUpload(
    const CreditCard& card,
     std::unique_ptr<base::DictionaryValue> legal_message,
     bool should_cvc_be_requested,
     const base::Closure& save_card_callback) {
   is_uploading_ = true;
   is_reshow_ = false;
   should_cvc_be_requested_ = should_cvc_be_requested;
  AutofillMetrics::LogSaveCardPromptMetric(
      AutofillMetrics::SAVE_CARD_PROMPT_SHOW_REQUESTED, is_uploading_,
      is_reshow_,
      pref_service_->GetInteger(
          prefs::kAutofillAcceptSaveCreditCardPromptState));

  if (!LegalMessageLine::Parse(*legal_message, &legal_message_lines_)) {
    AutofillMetrics::LogSaveCardPromptMetric(
        AutofillMetrics::SAVE_CARD_PROMPT_END_INVALID_LEGAL_MESSAGE,
        is_uploading_, is_reshow_,
        pref_service_->GetInteger(
            prefs::kAutofillAcceptSaveCreditCardPromptState));
    return;
  }

  card_ = card;
  save_card_callback_ = save_card_callback;
  ShowBubble();
}

Vulnerability Type: 
CWE ID: CWE-416
Summary: A use after free in credit card autofill in Google Chrome prior to 59.0.3071.86 for Linux and Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Commit Message: [autofill] Avoid duplicate instances of the SaveCardBubble.

autofill::SaveCardBubbleControllerImpl::ShowBubble() expects
(via DCHECK) to only be called when the save card bubble is
not already visible. This constraint is violated if the user
clicks multiple times on a submit button.

If the underlying page goes away, the last SaveCardBubbleView
created by the controller will be automatically cleaned up,
but any others are left visible on the screen... holding a
refence to a possibly-deleted controller.

This CL early exits the ShowBubbleFor*** and ReshowBubble logic
if the bubble is already visible.

BUG=708819

Review-Url: https://codereview.chromium.org/2862933002
Cr-Commit-Position: refs/heads/master@{#469768}