Fix race condition in utility process clients

content/browser/utility_process_host.h

Index: content/browser/utility_process_host.h
diff --git a/content/browser/utility_process_host.h b/content/browser/utility_process_host.h
index 779c8499f10b31d122de37739e45709315195b30..d78dbd0698edc67347c0c15a51a24773cf845a19 100644
--- a/content/browser/utility_process_host.h
+++ b/content/browser/utility_process_host.h
@@ -12,6 +12,7 @@
 #include "base/basictypes.h"
 #include "base/memory/ref_counted.h"
 #include "base/process_util.h"
+#include "base/memory/weak_ptr.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/browser_child_process_host_delegate.h"
 #include "content/public/browser/browser_thread.h"
@@ -26,9 +27,13 @@ class BrowserChildProcessHostImpl;
 // If you need multiple batches of work to be done in the sandboxed process,
 // use StartBatchMode(), then multiple calls to StartFooBar(p),
 // then finish with EndBatchMode().
+//
+// Note: If your class keeps a ptr to an object of this type, grab a weak ptr to
+// avoid a use after free.  See http://crbug.com/108871.
 class CONTENT_EXPORT UtilityProcessHost
     : public content::BrowserChildProcessHostDelegate,
-      public IPC::Message::Sender {
+      public IPC::Message::Sender,
+      public base::SupportsWeakPtr<UtilityProcessHost> {
  public:
   // An interface to be implemented by consumers of the utility process to
   // get results back.  All functions are called on the thread passed along