AppCache: Use WeakPtr<> to fix a potential uaf bug.

content/browser/appcache/appcache_dispatcher_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/appcache/appcache_dispatcher_host.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "content/browser/appcache/chrome_appcache_service.h"
 #include "content/browser/bad_message.h"
 #include "content/common/appcache_messages.h"
 #include "content/public/browser/user_metrics.h"
 
 namespace content {
 
 AppCacheDispatcherHost::AppCacheDispatcherHost(
     ChromeAppCacheService* appcache_service,
     int process_id)
     : BrowserMessageFilter(AppCacheMsgStart),
       appcache_service_(appcache_service),
       frontend_proxy_(this),
-      process_id_(process_id) {
+      process_id_(process_id),
+      weak_factory_(this) {
 }
 
 void AppCacheDispatcherHost::OnChannelConnected(int32 peer_pid) {
   if (appcache_service_.get()) {
     backend_impl_.Initialize(
         appcache_service_.get(), &frontend_proxy_, process_id_);
     get_status_callback_ =
         base::Bind(&AppCacheDispatcherHost::GetStatusCallback,
-                   base::Unretained(this));
+                    weak_factory_.GetWeakPtr());
     start_update_callback_ =
         base::Bind(&AppCacheDispatcherHost::StartUpdateCallback,
-                   base::Unretained(this));
+                    weak_factory_.GetWeakPtr());
     swap_cache_callback_ =
         base::Bind(&AppCacheDispatcherHost::SwapCacheCallback,
-                   base::Unretained(this));
+                    weak_factory_.GetWeakPtr());
   }
 }
 
 bool AppCacheDispatcherHost::OnMessageReceived(const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(AppCacheDispatcherHost, message)
     IPC_MESSAGE_HANDLER(AppCacheHostMsg_RegisterHost, OnRegisterHost)
     IPC_MESSAGE_HANDLER(AppCacheHostMsg_UnregisterHost, OnUnregisterHost)
     IPC_MESSAGE_HANDLER(AppCacheHostMsg_SetSpawningHostId, OnSetSpawningHostId)
     IPC_MESSAGE_HANDLER(AppCacheHostMsg_GetResourceList, OnGetResourceList)
@@ skipping 174 matching lines @@
 }
 
 void AppCacheDispatcherHost::SwapCacheCallback(bool result, void* param) {
   IPC::Message* reply_msg = reinterpret_cast<IPC::Message*>(param);
   DCHECK_EQ(pending_reply_msg_.get(), reply_msg);
   AppCacheHostMsg_SwapCache::WriteReplyParams(reply_msg, result);
   Send(pending_reply_msg_.release());
 }
 
 }  // namespace content