Making sure that SpeechRecognitionDispatcherHost is not used after free

content/browser/speech/speech_recognition_manager_impl.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/speech/speech_recognition_manager_impl.h"
 
 #include "base/bind.h"
 #include "content/browser/browser_main_loop.h"
 #include "content/browser/renderer_host/media/media_stream_manager.h"
 #include "content/browser/renderer_host/media/media_stream_ui_proxy.h"
@@ skipping 432 matching lines @@
     }
   }
   return kSessionIDInvalid;
 }
 
 SpeechRecognitionSessionContext
 SpeechRecognitionManagerImpl::GetSessionContext(int session_id) const {
   return GetSession(session_id)->context;
 }
 
-void SpeechRecognitionManagerImpl::AbortAllSessionsForListener(
-    SpeechRecognitionEventListener* listener) {
+void SpeechRecognitionManagerImpl::AbortAllSessionsForRenderProcess(
+    int render_process_id) {
   // This method gracefully destroys sessions for the listener. However, since
   // the listener itself is likely to be destroyed after this call, we avoid
   // dispatching further events to it, marking the |listener_is_active| flag.
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   for (SessionsTable::iterator it = sessions_.begin(); it != sessions_.end();
        ++it) {
     Session* session = it->second;
-    if (session->config.event_listener == listener) {
+    if (session->context.render_process_id == render_process_id) {
       AbortSession(session->id);
       session->listener_is_active = false;
     }
   }
 }
 
 void SpeechRecognitionManagerImpl::AbortAllSessionsForRenderView(
     int render_process_id,
     int render_view_id) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
@@ skipping 176 matching lines @@
 SpeechRecognitionManagerImpl::GetSession(int session_id) const {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   SessionsTable::const_iterator iter = sessions_.find(session_id);
   DCHECK(iter != sessions_.end());
   return iter->second;
 }
 
 SpeechRecognitionEventListener* SpeechRecognitionManagerImpl::GetListener(
     int session_id) const {
   Session* session = GetSession(session_id);
-  return session->listener_is_active ? session->config.event_listener : NULL;
+  if (session->listener_is_active && session->config.event_listener)
+    return session->config.event_listener.get();
+  return NULL;
 }
 
 SpeechRecognitionEventListener*
 SpeechRecognitionManagerImpl::GetDelegateListener() const {
   return delegate_.get() ? delegate_->GetEventListener() : NULL;
 }
 
 const SpeechRecognitionSessionConfig&
 SpeechRecognitionManagerImpl::GetSessionConfig(int session_id) const {
   return GetSession(session_id)->config;
@@ skipping 18 matching lines @@
 SpeechRecognitionManagerImpl::Session::Session()
   : id(kSessionIDInvalid),
     abort_requested(false),
     listener_is_active(true) {
 }
 
 SpeechRecognitionManagerImpl::Session::~Session() {
 }
 
 }  // namespace content