Fix UAF crash in PermissionServiceContext::CreateServiceForWorker

This CL recreates the |permission_service_context_| on-demand in
RenderProcessHostImpl::CreatePermissionService to avoid accessing
the nullptr.

Bug: 1036779
Change-Id: I1f464de70a6e4b281380b9b83fee06e012831236
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2014720Reviewed-by: Balazs Engedy <engedy@chromium.org>
Reviewed-by: Bo <boliu@chromium.org>
Commit-Queue: Miyoung Shin <myid.shin@igalia.com>
Cr-Commit-Position: refs/heads/master@{#735402}

content/browser/renderer_host/render_process_host_impl.cc

@@ -1497,7 +1497,6 @@ RenderProcessHostImpl::RenderProcessHostImpl(
       is_unused_(true),
       delayed_cleanup_needed_(false),
       within_process_died_observer_(false),
-      permission_service_context_(new PermissionServiceContext(this)),
       indexed_db_factory_(
           new IndexedDBDispatcherHost(
               id_,
@@ -2014,6 +2013,10 @@ void RenderProcessHostImpl::CreatePermissionService(
     const url::Origin& origin,
     mojo::PendingReceiver<blink::mojom::PermissionService> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
+  if (!permission_service_context_)
+    permission_service_context_.reset(new PermissionServiceContext(this));
+
   permission_service_context_->CreateServiceForWorker(origin,
                                                       std::move(receiver));
 }