Fix UAF in ImportantFileWriter.

DeleteTmpFileWithRetry() must pass the histogram suffix as a std::string
rather than a StringPiece when posting its delayed task.

BUG=1112511
R=thestig@chromium.org

Change-Id: I824e90e9e32b6587154de040c0da3cb7d30c8cab
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2339737Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
Commit-Queue: Greg Thompson <grt@chromium.org>
Auto-Submit: Greg Thompson <grt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#795239}

base/files/important_file_writer.cc

@@ -129,7 +129,11 @@ void DeleteTmpFileWithRetry(File tmp_file,
                !SequencedTaskRunnerHandle::Get()->PostDelayedTask(
                    FROM_HERE,
                    BindOnce(&DeleteTmpFileWithRetry, base::File(),
-                            tmp_file_path, histogram_suffix, attempt),
+                            tmp_file_path,
+                            // Pass the suffix as a std::string rather than a
+                            // StringPiece since the latter references memory
+                            // owned by this function's caller.
+                            std::string(histogram_suffix), attempt),
                    kDeleteFileRetryDelay)) {
       // Retries are not possible, so record the simple delete error.
       UmaHistogramExactLinearWithSuffix("ImportantFile.FileDeleteNoRetryError",