[Backport] Security bug 1180871

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/2713912:
Don't store BlobStorageLimits as a reference in transport strategy.

Rather than storing a const reference to something of unclear lifetime,
just make a copy. We could just copy the specific limits we need, but
there shouldn't be many TransportStrategy instances alive at the same
time anyway, so the cost of duplicating shouldn't be too high.

Bug: 1180871
Change-Id: Ie1e31728b18f02c5d35df0ac0f285eb8f70cb268
Reviewed-by: Olivier Yiptong <oyiptong@chromium.org>
Reviewed-by: Darwin Huang <huangdarwin@chromium.org>
Reviewed-by: Victor Costan <pwnall@chromium.org>
Commit-Queue: Marijn Kruisselbrink <mek@chromium.org>
Cr-Commit-Position: refs/heads/master@{#856503}
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
Reviewed-by: Jüri Valdmann <juri.valdmann@qt.io>

1 files changed, 2 insertions, 2 deletions

diff --git a/chromium/storage/browser/blob/blob_transport_strategy.cc b/chromium/storage/browser/blob/blob_transport_strategy.cc
index f9c40e77b32..db542b41697 100644
--- a/chromium/storage/browser/blob/blob_transport_strategy.cc
+++ b/chromium/storage/browser/blob/blob_transport_strategy.cc
@@ -236,7 +236,7 @@ class DataPipeTransportStrategy : public BlobTransportStrategy {
     }
   }
 
-  const BlobStorageLimits& limits_;
+  const BlobStorageLimits limits_;
   base::circular_deque<base::OnceClosure> requests_;
 
   mojo::ScopedDataPipeConsumerHandle consumer_handle_;
@@ -332,7 +332,7 @@ class FileTransportStrategy : public BlobTransportStrategy {
       std::move(result_callback_).Run(BlobStatus::DONE);
   }
 
-  const BlobStorageLimits& limits_;
+  const BlobStorageLimits limits_;
 
   // State used to assign bytes elements to individual files.
   // The index of the first file that still has available space.