Making sure that SpeechRecognitionDispatcherHost is not used after free

content/browser/speech/speech_recognition_dispatcher_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/speech/speech_recognition_dispatcher_host.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/lazy_instance.h"
 #include "content/browser/browser_plugin/browser_plugin_guest.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/speech/speech_recognition_manager_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/common/speech_recognition_messages.h"
 #include "content/public/browser/speech_recognition_manager_delegate.h"
 #include "content/public/browser/speech_recognition_session_config.h"
 #include "content/public/browser/speech_recognition_session_context.h"
 #include "content/public/common/content_switches.h"
 
 namespace content {
 
 SpeechRecognitionDispatcherHost::SpeechRecognitionDispatcherHost(
     bool is_guest,
     int render_process_id,
     net::URLRequestContextGetter* context_getter)
     : BrowserMessageFilter(SpeechRecognitionMsgStart),
       is_guest_(is_guest),
       render_process_id_(render_process_id),
-      context_getter_(context_getter) {
+      context_getter_(context_getter),
+      weak_factory_(this) {
   // Do not add any non-trivial initialization here, instead do it lazily when
   // required (e.g. see the method |SpeechRecognitionManager::GetInstance()|) or
   // add an Init() method.
 }
 
 SpeechRecognitionDispatcherHost::~SpeechRecognitionDispatcherHost() {
-  SpeechRecognitionManager::GetInstance()->AbortAllSessionsForListener(this);
+  SpeechRecognitionManager::GetInstance()->AbortAllSessionsForRenderProcess(
+      render_process_id_);
+  weak_factory_.InvalidateWeakPtrs();
+}
+
+base::WeakPtr<SpeechRecognitionDispatcherHost>
+SpeechRecognitionDispatcherHost::AsWeakPtr() {
+  return weak_factory_.GetWeakPtr();
 }
 
 bool SpeechRecognitionDispatcherHost::OnMessageReceived(
     const IPC::Message& message, bool* message_was_ok) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP_EX(SpeechRecognitionDispatcherHost, message,
                            *message_was_ok)
     IPC_MESSAGE_HANDLER(SpeechRecognitionHostMsg_StartRequest,
                         OnStartRequest)
     IPC_MESSAGE_HANDLER(SpeechRecognitionHostMsg_AbortRequest,
                         OnAbortRequest)
     IPC_MESSAGE_HANDLER(SpeechRecognitionHostMsg_StopCaptureRequest,
                         OnStopCaptureRequest)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   return handled;
 }
 
 void SpeechRecognitionDispatcherHost::OverrideThreadForMessage(
     const IPC::Message& message,
     BrowserThread::ID* thread) {
   if (message.type() == SpeechRecognitionHostMsg_StartRequest::ID)
     *thread = BrowserThread::UI;
 }
 
+void SpeechRecognitionDispatcherHost::OnChannelClosing() {
+  weak_factory_.InvalidateWeakPtrs();
+}
+
 void SpeechRecognitionDispatcherHost::OnStartRequest(
     const SpeechRecognitionHostMsg_StartRequest_Params& params) {
   SpeechRecognitionHostMsg_StartRequest_Params input_params(params);
 
   int embedder_render_process_id = 0;
   int embedder_render_view_id = MSG_ROUTING_NONE;
   if (is_guest_) {
     // If the speech API request was from a guest, save the context of the
     // embedder since we will use it to decide permission.
     RenderViewHostImpl* render_view_host =
@@ skipping 50 matching lines @@
   config.is_legacy_api = false;
   config.language = params.language;
   config.grammars = params.grammars;
   config.max_hypotheses = params.max_hypotheses;
   config.origin_url = params.origin_url;
   config.initial_context = context;
   config.url_request_context_getter = context_getter_.get();
   config.filter_profanities = filter_profanities;
   config.continuous = params.continuous;
   config.interim_results = params.interim_results;
-  config.event_listener = this;
+  config.event_listener = this->AsWeakPtr();
 
   int session_id = SpeechRecognitionManager::GetInstance()->CreateSession(
       config);
   DCHECK_NE(session_id, SpeechRecognitionManager::kSessionIDInvalid);
   SpeechRecognitionManager::GetInstance()->StartSession(session_id);
 }
 
 void SpeechRecognitionDispatcherHost::OnAbortRequest(int render_view_id,
                                                      int request_id) {
   int session_id = SpeechRecognitionManager::GetInstance()->GetSession(
@@ skipping 86 matching lines @@
 void SpeechRecognitionDispatcherHost::OnAudioLevelsChange(int session_id,
                                                           float volume,
                                                           float noise_volume) {
 }
 
 void SpeechRecognitionDispatcherHost::OnEnvironmentEstimationComplete(
     int session_id) {
 }
 
 }  // namespace content