Fix race condition in utility process clients

content/browser/utility_process_host.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_UTILITY_PROCESS_HOST_H_
 #define CONTENT_BROWSER_UTILITY_PROCESS_HOST_H_
 #pragma once
 
 #include <string>
 #include <vector>
 
 #include "base/basictypes.h"
 #include "base/memory/ref_counted.h"
 #include "base/process_util.h"
+#include "base/memory/weak_ptr.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/browser_child_process_host_delegate.h"
 #include "content/public/browser/browser_thread.h"
 #include "ipc/ipc_message.h"
 
 class BrowserChildProcessHostImpl;
 
 // This class acts as the browser-side host to a utility child process.  A
 // utility process is a short-lived sandboxed process that is created to run
 // a specific task.  This class lives solely on the IO thread.
 // If you need a single method call in the sandbox, use StartFooBar(p).
 // If you need multiple batches of work to be done in the sandboxed process,
 // use StartBatchMode(), then multiple calls to StartFooBar(p),
 // then finish with EndBatchMode().
+//
+// Note: If your class keeps a ptr to an object of this type, grab a weak ptr to
+// avoid a use after free.  See http://crbug.com/108871.
 class CONTENT_EXPORT UtilityProcessHost
     : public content::BrowserChildProcessHostDelegate,
-      public IPC::Message::Sender {
+      public IPC::Message::Sender,
+      public base::SupportsWeakPtr<UtilityProcessHost> {
  public:
   // An interface to be implemented by consumers of the utility process to
   // get results back.  All functions are called on the thread passed along
   // to UtilityProcessHost.
   class CONTENT_EXPORT Client : public base::RefCountedThreadSafe<Client> {
    public:
     Client();
 
     // Called when the process has crashed.
     virtual void OnProcessCrashed(int exit_code);
@@ skipping 72 matching lines @@
   base::environment_vector env_;
 
   bool started_;
 
   scoped_ptr<BrowserChildProcessHostImpl> process_;
 
   DISALLOW_COPY_AND_ASSIGN(UtilityProcessHost);
 };
 
 #endif  // CONTENT_BROWSER_UTILITY_PROCESS_HOST_H_