Fix crash from ipc_fuzzer

chrome/browser/printing/print_job_worker.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/printing/print_job_worker.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/callback.h"
 #include "base/compiler_specific.h"
@@ skipping 75 matching lines @@
                           PrintedDocument* document,
                           PrintedPage* page) {
   JobEventDetails* details = new JobEventDetails(detail_type, document, page);
   content::NotificationService::current()->Notify(
       chrome::NOTIFICATION_PRINT_JOB_EVENT,
       // We know that is is a PrintJob object in this circumstance.
       content::Source<PrintJob>(static_cast<PrintJob*>(print_job)),
       content::Details<JobEventDetails>(details));
 }
 
+void PostOnOwnerThread(const scoped_refptr<PrintJobWorkerOwner>& owner,
+                       const PrintingContext::PrintSettingsCallback& callback,
+                       PrintingContext::Result result) {
+  owner->PostTask(FROM_HERE, base::Bind(&HoldRefCallback, owner,
+                                        base::Bind(callback, result)));
+}
+
 }  // namespace
 
 PrintJobWorker::PrintJobWorker(int render_process_id,
                                int render_view_id,
                                PrintJobWorkerOwner* owner)
     : owner_(owner), thread_("Printing_Worker"), weak_factory_(this) {
   // The object is created in the IO thread.
   DCHECK(owner_->RunsTasksOnCurrentThread());
 
   printing_context_delegate_.reset(
@@ skipping 106 matching lines @@
     TabAndroid* tab = TabAndroid::FromWebContents(web_contents);
 
     // Regardless of whether the following call fails or not, the javascript
     // call will return since startPendingPrint will make it return immediately
     // in case of error.
     if (tab)
       tab->SetPendingPrint();
   }
 #endif
 
+  // weak_factory_ creates pointers valid only on owner_ thread.
   printing_context_->AskUserForSettings(
-      document_page_count,
-      has_selection,
-      is_scripted,
-      base::Bind(&PrintJobWorker::GetSettingsWithUIDone,
-                 base::Unretained(this)));
-}
-
-void PrintJobWorker::GetSettingsWithUIDone(PrintingContext::Result result) {
-  PostTask(FROM_HERE,
-           base::Bind(&HoldRefCallback,
-                      make_scoped_refptr(owner_),
-                      base::Bind(&PrintJobWorker::GetSettingsDone,
-                                 base::Unretained(this),
-                                 result)));
+      document_page_count, has_selection, is_scripted,
+      base::Bind(&PostOnOwnerThread, make_scoped_refptr(owner_),
+                 base::Bind(&PrintJobWorker::GetSettingsDone,
+                            weak_factory_.GetWeakPtr())));
 }
 
 void PrintJobWorker::UseDefaultSettings() {
   PrintingContext::Result result = printing_context_->UseDefaultSettings();
   GetSettingsDone(result);
 }
 
 void PrintJobWorker::StartPrinting(PrintedDocument* new_document) {
   DCHECK(task_runner_->RunsTasksOnCurrentThread());
   DCHECK_EQ(page_number_, PageNumber::npos());
@@ skipping 186 matching lines @@
                               document_,
                               scoped_refptr<PrintedPage>()));
   Cancel();
 
   // Makes sure the variables are reinitialized.
   document_ = NULL;
   page_number_ = PageNumber::npos();
 }
 
 }  // namespace printing