AppCache: Use WeakPtr<> to fix a potential uaf bug.

content/browser/appcache/appcache_dispatcher_host.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_APPCACHE_APPCACHE_DISPATCHER_HOST_H_
 #define CONTENT_BROWSER_APPCACHE_APPCACHE_DISPATCHER_HOST_H_
 
 #include <vector>
 
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/process/process.h"

[michaeln, 2015/11/13 00:02:39]

i'll add the include here too

 #include "content/browser/appcache/appcache_backend_impl.h"
 #include "content/browser/appcache/appcache_frontend_proxy.h"
 #include "content/public/browser/browser_message_filter.h"
 
 namespace content {
 class ChromeAppCacheService;
 
 // Handles appcache related messages sent to the main browser process from
 // its child processes. There is a distinct host for each child process.
 // Messages are handled on the IO thread. The RenderProcessHostImpl creates
@@ skipping 39 matching lines @@
   AppCacheBackendImpl backend_impl_;
 
   content::GetStatusCallback get_status_callback_;
   content::StartUpdateCallback start_update_callback_;
   content::SwapCacheCallback swap_cache_callback_;
   scoped_ptr<IPC::Message> pending_reply_msg_;
 
   // The corresponding ChildProcessHost object's id().
   int process_id_;
 
+  base::WeakPtrFactory<AppCacheDispatcherHost> weak_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(AppCacheDispatcherHost);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_APPCACHE_APPCACHE_DISPATCHER_HOST_H_