Fix user-after-free error with ObserverList. The problem is that if an ObserverListBase::Iterato...

base/observer_list.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_OBSERVER_LIST_H__
 #define BASE_OBSERVER_LIST_H__
 #pragma once
 
 #include <algorithm>
 #include <limits>
 #include <vector>
 
 #include "base/basictypes.h"
 #include "base/logging.h"
+#include "base/memory/weak_ptr.h"
 
 ///////////////////////////////////////////////////////////////////////////////
 //
 // OVERVIEW:
 //
 //   A container for a list of observers.  Unlike a normal STL vector or list,
 //   this container can be modified during iteration without invalidating the
 //   iterator.  So, it safely handles the case of an observer removing itself
 //   or other observers from the list while observers are being notified.
 //
@@ skipping 29 matching lines @@
 //     ObserverList<Observer> observer_list_;
 //   };
 //
 //
 ///////////////////////////////////////////////////////////////////////////////
 
 template <typename ObserverType>
 class ObserverListThreadSafe;
 
 template <class ObserverType>
-class ObserverListBase {
+class ObserverListBase
+    : public base::SupportsWeakPtr<ObserverListBase<ObserverType> > {
  public:
   // Enumeration of which observers are notified.
   enum NotificationType {
     // Specifies that any observers added during notification are notified.
     // This is the default type if non type is provided to the constructor.
     NOTIFY_ALL,
 
     // Specifies that observers added while sending out notification are not
     // notified.
     NOTIFY_EXISTING_ONLY
   };
 
   // An iterator class that can be used to access the list of observers.  See
   // also the FOR_EACH_OBSERVER macro defined below.
   class Iterator {
    public:
     Iterator(ObserverListBase<ObserverType>& list)
-        : list_(list),
+        : list_(list.AsWeakPtr()),
           index_(0),
           max_index_(list.type_ == NOTIFY_ALL ?
                      std::numeric_limits<size_t>::max() :
                      list.observers_.size()) {
-      ++list_.notify_depth_;
+      ++list_->notify_depth_;
     }
 
     ~Iterator() {
-      if (--list_.notify_depth_ == 0)
-        list_.Compact();
+      if (list_ && --list_->notify_depth_ == 0)
+        list_->Compact();
     }
 
     ObserverType* GetNext() {
-      ListType& observers = list_.observers_;
+      if (!list_)
+        return NULL;
+      ListType& observers = list_->observers_;
       // Advance if the current element is null
       size_t max_index = std::min(max_index_, observers.size());
       while (index_ < max_index && !observers[index_])
         ++index_;
       return index_ < max_index ? observers[index_++] : NULL;
     }
 
    private:
-    ObserverListBase<ObserverType>& list_;
+    base::WeakPtr<ObserverListBase<ObserverType> > list_;
     size_t index_;
     size_t max_index_;
   };
 
   ObserverListBase() : notify_depth_(0), type_(NOTIFY_ALL) {}
   explicit ObserverListBase(NotificationType type)
       : notify_depth_(0), type_(type) {}
 
   // Add an observer to the list.  An observer should not be added to
   // the same list more than once.
@@ skipping 87 matching lines @@
 
 #define FOR_EACH_OBSERVER(ObserverType, observer_list, func)  \
   do {                                                        \
     ObserverListBase<ObserverType>::Iterator it(observer_list);   \
     ObserverType* obs;                                        \
     while ((obs = it.GetNext()) != NULL)                      \
       obs->func;                                              \
   } while (0)
 
 #endif  // BASE_OBSERVER_LIST_H__