Fix GpuChannelHost destruction races.

content/common/gpu/client/gpu_channel_host.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_COMMON_GPU_CLIENT_GPU_CHANNEL_HOST_H_
 #define CONTENT_COMMON_GPU_CLIENT_GPU_CHANNEL_HOST_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 60 matching lines @@
   virtual void CreateImage(
       gfx::PluginWindowHandle window,
       int32 image_id,
       const CreateImageCallback& callback) = 0;
   virtual void DeleteImage(int32 image_id, int32 sync_point) = 0;
 };
 
 // Encapsulates an IPC channel between the client and one GPU process.
 // On the GPU process side there's a corresponding GpuChannel.
 class GpuChannelHost : public IPC::Sender,
-                       public base::RefCountedThreadSafe<GpuChannelHost> {
+                       public base::RefCountedThreadSafe<GpuChannelHost>,
+                       public base::SupportsWeakPtr<GpuChannelHost> {
  public:
   enum State {
     // Not yet connected.
     kUnconnected,
     // Ready to use.
     kConnected,
     // An error caused the host to become disconnected. Recreate channel to
     // reestablish connection.
     kLost
   };
@@ skipping 86 matching lines @@
   friend class base::RefCountedThreadSafe<GpuChannelHost>;
   virtual ~GpuChannelHost();
 
   // Message handlers.
   void OnGenerateMailboxNamesReply(const std::vector<std::string>& names);
 
   // A filter used internally to route incoming messages from the IO thread
   // to the correct message loop.
   class MessageFilter : public IPC::ChannelProxy::MessageFilter {
    public:
-    explicit MessageFilter(GpuChannelHost* parent);
+    MessageFilter(base::WeakPtr<GpuChannelHost> parent,
+                  GpuChannelHostFactory* factory);
 
     void AddRoute(int route_id,
                   base::WeakPtr<IPC::Listener> listener,
                   scoped_refptr<base::MessageLoopProxy> loop);
     void RemoveRoute(int route_id);
 
     // IPC::ChannelProxy::MessageFilter implementation:
     virtual bool OnMessageReceived(const IPC::Message& msg) OVERRIDE;
     virtual void OnChannelError() OVERRIDE;
 
    private:
     virtual ~MessageFilter();
 
-    GpuChannelHost* parent_;
+    // Note: this reference can only be used to post tasks back to the
+    // GpuChannelHost, it is illegal to dereference on the IO thread where the
+    // MessageFilter lives.
+    base::WeakPtr<GpuChannelHost> parent_;
+
+    GpuChannelHostFactory* factory_;
 
     typedef base::hash_map<int, GpuListenerInfo> ListenerMap;
     ListenerMap listeners_;
   };
 
   GpuChannelHostFactory* factory_;
   int client_id_;
   int gpu_host_id_;
 
   State state_;
@@ skipping 19 matching lines @@
 
   // Transfer buffer IDs are allocated in sequence.
   base::AtomicSequenceNumber next_transfer_buffer_id_;
 
   DISALLOW_COPY_AND_ASSIGN(GpuChannelHost);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_COMMON_GPU_CLIENT_GPU_CHANNEL_HOST_H_