Fix cancellation of a pair of URLRequestJob subclasses

content/browser/webui/url_data_manager_backend.cc

Index: content/browser/webui/url_data_manager_backend.cc
diff --git a/content/browser/webui/url_data_manager_backend.cc b/content/browser/webui/url_data_manager_backend.cc
index ba1f5d4646e05e7298698d9320121da7aa85489b..d6434f03707d775510f705c695aa21536a26dd19 100644
--- a/content/browser/webui/url_data_manager_backend.cc
+++ b/content/browser/webui/url_data_manager_backend.cc
@@ -111,8 +111,7 @@ std::string GetOriginHeaderValue(const net::URLRequest* request) {
 // chrome-internal resource requests asynchronously.
 // It hands off URL requests to ChromeURLDataManager, which asynchronously
 // calls back once the data is available.
-class URLRequestChromeJob : public net::URLRequestJob,
-                            public base::SupportsWeakPtr<URLRequestChromeJob> {
+class URLRequestChromeJob : public net::URLRequestJob {
  public:
   // |is_incognito| set when job is generated from an incognito profile.
   URLRequestChromeJob(net::URLRequest* request,
@@ -135,6 +134,9 @@ class URLRequestChromeJob : public net::URLRequestJob,
   // for us.
   void DataAvailable(base::RefCountedMemory* bytes);
 
+  // Returns a weak pointer to the job.
+  base::WeakPtr<URLRequestChromeJob> AsWeakPtr();

[davidben, 2015/08/05 18:56:39]

Yuck. :-(

[davidben, 2015/08/05 18:57:08]

[To be clear, nothing actionable. I found the place where we call it and fixing
that probably needn't be done in this CL.]

[mmenke, 2015/08/05 20:00:24]

I completely agree on both counts.  The way the 3 classes are intertwined here
is really ugly.  Spent a little time looking for a really simple fix for this,
but seemed like it would require more work than I'm prepared to spend on it.

+
   void set_mime_type(const std::string& mime_type) {
     mime_type_ = mime_type;
   }
@@ -267,13 +269,16 @@ void URLRequestChromeJob::Start() {
       BrowserThread::UI,
       FROM_HERE,
       base::Bind(&URLRequestChromeJob::CheckStoragePartitionMatches,
-                 render_process_id, request_->url(), AsWeakPtr()));
+                 render_process_id, request_->url(),
+                 weak_factory_.GetWeakPtr()));
   TRACE_EVENT_ASYNC_BEGIN1("browser", "DataManager:Request", this, "URL",
       request_->url().possibly_invalid_spec());
 }
 
 void URLRequestChromeJob::Kill() {
+  weak_factory_.InvalidateWeakPtrs();
   backend_->RemoveRequest(this);
+  URLRequestJob::Kill();
 }
 
 bool URLRequestChromeJob::GetMimeType(std::string* mime_type) const {
@@ -349,6 +354,10 @@ void URLRequestChromeJob::DataAvailable(base::RefCountedMemory* bytes) {
   }
 }
 
+base::WeakPtr<URLRequestChromeJob> URLRequestChromeJob::AsWeakPtr() {
+  return weak_factory_.GetWeakPtr();
+}
+
 bool URLRequestChromeJob::ReadRawData(net::IOBuffer* buf, int buf_size,
                                       int* bytes_read) {
   if (!data_.get()) {