Fix race condition in utility process clients

content/browser/utility_process_host.h

Index: content/browser/utility_process_host.h
diff --git a/content/browser/utility_process_host.h b/content/browser/utility_process_host.h
index 779c8499f10b31d122de37739e45709315195b30..ef28fecd5a38f19378f5fe7eeff0ac2eb780189f 100644
--- a/content/browser/utility_process_host.h
+++ b/content/browser/utility_process_host.h
@@ -12,6 +12,7 @@
 #include "base/basictypes.h"
 #include "base/memory/ref_counted.h"
 #include "base/process_util.h"
+#include "base/memory/weak_ptr.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/browser_child_process_host_delegate.h"
 #include "content/public/browser/browser_thread.h"
@@ -26,9 +27,14 @@ class BrowserChildProcessHostImpl;
 // If you need multiple batches of work to be done in the sandboxed process,
 // use StartBatchMode(), then multiple calls to StartFooBar(p),
 // then finish with EndBatchMode().
+//
+// Note: If you keep a ptr to an object of this class that is used in a task

[jam, 2012/01/26 23:32:15]

nit: i think what you want to say here is that if you keep a ptr period. the
pointer has to be used only on the IO thread. if their client is on the UI
thread, for ex, they're obviously hosed. but they're also hosed if it's on the
IO thread, there's still a PostTask to the thread as well (maybe that should be
a straight function call if it's IO thread).

+// other than the one in which it was created, grab a weak ptr to it to avoid
+// a use after free.  See http://crbug.com/108871.
 class CONTENT_EXPORT UtilityProcessHost
     : public content::BrowserChildProcessHostDelegate,
-      public IPC::Message::Sender {
+      public IPC::Message::Sender,
+      public base::SupportsWeakPtr<UtilityProcessHost> {
  public:
   // An interface to be implemented by consumers of the utility process to
   // get results back.  All functions are called on the thread passed along