Fix race condition in utility process clients

content/browser/in_process_webkit/indexed_db_key_utility_client.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/in_process_webkit/indexed_db_key_utility_client.h"
 
 #include "base/bind.h"
 #include "base/lazy_instance.h"
 #include "base/synchronization/waitable_event.h"
 #include "content/browser/utility_process_host.h"
@@ skipping 82 matching lines @@
     STATE_INITIALIZED,
     STATE_CREATING_KEYS,
     STATE_INJECTING_KEY,
     STATE_SHUTDOWN,
   };
   State state_;
   std::vector<IndexedDBKey> keys_;
   content::SerializedScriptValue value_after_injection_;
 
   // Used in the IO thread.
-  UtilityProcessHost* utility_process_host_;
+  base::WeakPtr<UtilityProcessHost> utility_process_host_;
   scoped_refptr<Client> client_;
 
   DISALLOW_COPY_AND_ASSIGN(KeyUtilityClientImpl);
 };
 
 // IndexedDBKeyUtilityClient definitions.
 
 static base::LazyInstance<IndexedDBKeyUtilityClient> client_instance =
     LAZY_INSTANCE_INITIALIZER;
 
@@ skipping 56 matching lines @@
   return instance->impl_->InjectIDBKeyIntoSerializedValue(key, value, key_path);
 }
 
 
 
 // KeyUtilityClientImpl definitions.
 
 void KeyUtilityClientImpl::Shutdown() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
 
-  utility_process_host_->EndBatchMode();
-  utility_process_host_ = NULL;
+  if (utility_process_host_) {
+    utility_process_host_->EndBatchMode();
+    utility_process_host_.reset();
+  }
   client_ = NULL;
   state_ = STATE_SHUTDOWN;
 }
 
 KeyUtilityClientImpl::KeyUtilityClientImpl()
     : waitable_event_(false, false),
-      state_(STATE_UNINITIALIZED),
-      utility_process_host_(NULL) {
+      state_(STATE_UNINITIALIZED) {
 }
 
 KeyUtilityClientImpl::~KeyUtilityClientImpl() {
   DCHECK(state_ == STATE_UNINITIALIZED || state_ == STATE_SHUTDOWN);
   DCHECK(!utility_process_host_);
   DCHECK(!client_.get());
 }
 
 void KeyUtilityClientImpl::StartUtilityProcess() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::WEBKIT_DEPRECATED));
@@ skipping 67 matching lines @@
     DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
     BrowserThread::PostTask(
         BrowserThread::IO, FROM_HERE,
         base::Bind(&KeyUtilityClientImpl::StartUtilityProcessInternal, this));
     return;
   }
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   DCHECK(state_ == STATE_UNINITIALIZED);
 
   client_ = new KeyUtilityClientImpl::Client(this);
-  utility_process_host_ = new UtilityProcessHost(
-      client_.get(), BrowserThread::IO);
+  utility_process_host_ = (new UtilityProcessHost(
+      client_.get(), BrowserThread::IO))->AsWeakPtr();
   utility_process_host_->set_use_linux_zygote(true);
   utility_process_host_->StartBatchMode();
   state_ = STATE_INITIALIZED;
   waitable_event_.Signal();
 }
 
 void KeyUtilityClientImpl::EndUtilityProcessInternal() {
   if (!BrowserThread::CurrentlyOn(BrowserThread::IO)) {
     BrowserThread::PostTask(
         BrowserThread::IO, FROM_HERE,
         base::Bind(&KeyUtilityClientImpl::EndUtilityProcessInternal, this));
     return;
   }
 
-  utility_process_host_->EndBatchMode();
-  utility_process_host_ = NULL;
+  if (utility_process_host_) {
+    utility_process_host_->EndBatchMode();
+    utility_process_host_.reset();
+  }
   client_ = NULL;
   state_ = STATE_SHUTDOWN;
   waitable_event_.Signal();
 }
 
 void KeyUtilityClientImpl::CallStartIDBKeyFromValueAndKeyPathFromIOThread(
     const std::vector<content::SerializedScriptValue>& values,
     const string16& key_path) {
   if (!BrowserThread::CurrentlyOn(BrowserThread::IO)) {
     BrowserThread::PostTask(
         BrowserThread::IO, FROM_HERE,
         base::Bind(&KeyUtilityClientImpl::
             CallStartIDBKeyFromValueAndKeyPathFromIOThread,
                    this, values, key_path));
     return;
   }
 
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
-  utility_process_host_->Send(new UtilityMsg_IDBKeysFromValuesAndKeyPath(
-      0, values, key_path));
+  if (utility_process_host_) {
+    utility_process_host_->Send(new UtilityMsg_IDBKeysFromValuesAndKeyPath(
+        0, values, key_path));
+  }
 }
 
 void KeyUtilityClientImpl::CallStartInjectIDBKeyFromIOThread(
     const IndexedDBKey& key,
     const content::SerializedScriptValue& value,
     const string16& key_path) {
   if (!BrowserThread::CurrentlyOn(BrowserThread::IO)) {
     BrowserThread::PostTask(
         BrowserThread::IO, FROM_HERE,
         base::Bind(&KeyUtilityClientImpl::CallStartInjectIDBKeyFromIOThread,
                    this, key, value, key_path));
     return;
   }
 
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
-  utility_process_host_->Send(new UtilityMsg_InjectIDBKey(
-      key, value, key_path));
+  if (utility_process_host_)
+    utility_process_host_->Send(new UtilityMsg_InjectIDBKey(
+        key, value, key_path));
 }
 
 void KeyUtilityClientImpl::SetKeys(const std::vector<IndexedDBKey>& keys) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   keys_ = keys;
 }
 
 void KeyUtilityClientImpl::FinishCreatingKeys() {
   DCHECK(state_ == STATE_CREATING_KEYS);
   state_ = STATE_INITIALIZED;
@@ skipping 12 matching lines @@
   waitable_event_.Signal();
 }
 
 KeyUtilityClientImpl::Client::Client(KeyUtilityClientImpl* parent)
     : parent_(parent) {
 }
 
 void KeyUtilityClientImpl::Client::OnProcessCrashed(int exit_code) {
   if (parent_->state_ == STATE_CREATING_KEYS)
     parent_->FinishCreatingKeys();
+  parent_->Shutdown();
 }
 
 bool KeyUtilityClientImpl::Client::OnMessageReceived(
     const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(KeyUtilityClientImpl::Client, message)
     IPC_MESSAGE_HANDLER(UtilityHostMsg_IDBKeysFromValuesAndKeyPath_Succeeded,
                         OnIDBKeysFromValuesAndKeyPathSucceeded)
     IPC_MESSAGE_HANDLER(UtilityHostMsg_IDBKeysFromValuesAndKeyPath_Failed,
                         OnIDBKeysFromValuesAndKeyPathFailed)
@@ skipping 13 matching lines @@
 void KeyUtilityClientImpl::Client::OnInjectIDBKeyFinished(
     const content::SerializedScriptValue& value) {
   parent_->SetValueAfterInjection(value);
   parent_->FinishInjectingKey();
 }
 
 void KeyUtilityClientImpl::Client::OnIDBKeysFromValuesAndKeyPathFailed(
     int id) {
   parent_->FinishCreatingKeys();
 }