Fix speech crash on render view swap.

chrome/browser/speech/chrome_speech_recognition_manager_delegate.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/speech/chrome_speech_recognition_manager_delegate.h"
 
 #include <set>
 #include <string>
 
 #include "base/bind.h"
@@ skipping 148 matching lines @@
     // Sessions initiated by speech input extension APIs will end up in a NULL
     // WebContent here, but they are properly managed by the
     // chrome::SpeechInputExtensionManager. However, sessions initiated within a
     // extension using the (new) speech JS APIs, will be properly handled here.
     // TODO(primiano) turn this line into a DCHECK once speech input extension
     // API is deprecated.
     if (!web_contents)
       return;
 
     // Avoid multiple registrations for the same |web_contents|.
-    if (FindWebContents(web_contents) !=  registered_web_contents_.end()) {
+    if (FindWebContents(web_contents) != registered_web_contents_.end())
       return;
-    }
+
     registered_web_contents_.push_back(new WebContentsTracker(
         web_contents, base::Bind(&TabWatcher::OnTabClosed,
                                  // |this| outlives WebContentsTracker.
                                  base::Unretained(this), web_contents),
         render_process_id, render_view_id));
   }
 
   void OnTabClosed(content::WebContents* web_contents) {
     ScopedVector<WebContentsTracker>::iterator iter =
         FindWebContents(web_contents);
     DCHECK(iter != registered_web_contents_.end());
     int render_process_id = (*iter)->render_process_id();
     int render_view_id = (*iter)->render_view_id();
     registered_web_contents_.erase(iter);
 
     tab_closed_callback_.Run(render_process_id, render_view_id);
   }
 
  private:
   class WebContentsTracker : public content::WebContentsObserver {
    public:
     WebContentsTracker(content::WebContents* web_contents,
                        const base::Closure& finished_callback,
                        int render_process_id,
                        int render_view_id)
         : content::WebContentsObserver(web_contents),
+          web_contents_(web_contents),
           finished_callback_(finished_callback),
           render_process_id_(render_process_id),
           render_view_id_(render_view_id) {}
 
     ~WebContentsTracker() override {}
 
     int render_process_id() const { return render_process_id_; }
     int render_view_id() const { return render_view_id_; }
+    const content::WebContents* GetWebContents() const { return web_contents_; }
 
    private:
     // content::WebContentsObserver overrides.
     void WebContentsDestroyed() override {
       Observe(nullptr);
       finished_callback_.Run();
       // NOTE: We are deleted now.
     }
     void RenderViewHostChanged(content::RenderViewHost* old_host,
                                content::RenderViewHost* new_host) override {
       Observe(nullptr);
       finished_callback_.Run();
       // NOTE: We are deleted now.
     }
 
+    // Raw pointer to our WebContents.
+    //
+    // Although we are a WebContentsObserver, calling
+    // WebContents::web_contents() would return NULL once we unregister
+    // ourselves in WebContentsDestroyed() or RenderViewHostChanged(). So we
+    // store a reference to perform cleanup.
+    const content::WebContents* const web_contents_;
     const base::Closure finished_callback_;
     const int render_process_id_;
     const int render_view_id_;
   };
 
   friend class base::RefCountedThreadSafe<TabWatcher>;
 
   ~TabWatcher() {
     // Must be destroyed on the UI thread due to |registrar_| non thread-safety.
     // TODO(lazyboy): Do we still need this?
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
   }
 
   // Helper function to find the iterator in |registered_web_contents_| which
   // contains |web_contents|.
   ScopedVector<WebContentsTracker>::iterator FindWebContents(
       content::WebContents* web_contents) {
     for (ScopedVector<WebContentsTracker>::iterator i(
              registered_web_contents_.begin());
          i != registered_web_contents_.end(); ++i) {
-      if ((*i)->web_contents() == web_contents)
+      if ((*i)->GetWebContents() == web_contents)
         return i;
     }
 
     return registered_web_contents_.end();
   }
 
   // Keeps track of which WebContent(s) have been registered, in order to avoid
   // double registrations on WebContentsObserver and to pass the correct render
   // process id and render view id to |tab_closed_callback_| after the process
   // has gone away.
@@ skipping 174 matching lines @@
   // Otherwise this should be a regular tab contents.
   allowed = true;
   check_permission = true;
 #endif
 
   BrowserThread::PostTask(BrowserThread::IO, FROM_HERE,
                           base::Bind(callback, check_permission, allowed));
 }
 
 }  // namespace speech