[aw] Fix null pointer dereference in aw_url_request_context_getter

Fix trying to access the proxy_config_service that was moved to the
url_request_context in InitializeURLRequestContext

Bug: 851995
Change-Id: Icc31c661ff4bd0e6b92d899a9d427ed75db0a295
Reviewed-on: https://chromium-review.googlesource.com/1234154Reviewed-by: Matt Menke <mmenke@chromium.org>
Reviewed-by: Tobias Sargeant <tobiasjs@chromium.org>
Commit-Queue: Laís Minchillo <laisminchillo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#593140}

android_webview/browser/net/aw_url_request_context_getter.cc

@@ -190,6 +190,7 @@ AwURLRequestContextGetter::AwURLRequestContextGetter(
       channel_id_path_(channel_id_path),
       net_log_(net_log),
       proxy_config_service_(std::move(config_service)),
+      proxy_config_service_android_(nullptr),
       http_user_agent_settings_(new AwHttpUserAgentSettings()) {
   // CreateSystemProxyConfigService for Android must be called on main thread.
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -293,6 +294,9 @@ void AwURLRequestContextGetter::InitializeURLRequestContext() {
         net::ProxyResolutionService::CreateFixed(proxy,
                                                  NO_TRAFFIC_ANNOTATION_YET));
   } else {
+    // Retain a pointer to the config proxy service before ownership is passed
+    // on.
+    proxy_config_service_android_ = proxy_config_service_.get();
     builder.set_proxy_resolution_service(
         net::ProxyResolutionService::CreateWithoutProxyResolver(
             std::move(proxy_config_service_), net_log_));
@@ -412,11 +416,15 @@ void AwURLRequestContextGetter::SetProxyOverride(
     const std::string& host,
     int port,
     const std::vector<std::string>& exclusion_list) {
-  proxy_config_service_->SetProxyOverride(host, port, exclusion_list);
+  if (proxy_config_service_android_ != NULL) {
+    proxy_config_service_android_->SetProxyOverride(host, port, exclusion_list);
+  }
 }
 
 void AwURLRequestContextGetter::ClearProxyOverride() {
-  proxy_config_service_->ClearProxyOverride();
+  if (proxy_config_service_android_ != NULL) {
+    proxy_config_service_android_->ClearProxyOverride();
+  }
 }
 
 }  // namespace android_webview

android_webview/browser/net/aw_url_request_context_getter.h

@@ -88,6 +88,7 @@ class AwURLRequestContextGetter : public net::URLRequestContextGetter {
 
   net::NetLog* net_log_;
   std::unique_ptr<net::ProxyConfigServiceAndroid> proxy_config_service_;
+  net::ProxyConfigServiceAndroid* proxy_config_service_android_;
   std::unique_ptr<net::URLRequestJobFactory> job_factory_;
   std::unique_ptr<net::HttpUserAgentSettings> http_user_agent_settings_;
   std::unique_ptr<net::FileNetLogObserver> file_net_log_observer_;