Making sure that SpeechRecognitionDispatcherHost is not used after free

content/browser/speech/input_tag_speech_dispatcher_host.cc

Index: content/browser/speech/input_tag_speech_dispatcher_host.cc
diff --git a/content/browser/speech/input_tag_speech_dispatcher_host.cc b/content/browser/speech/input_tag_speech_dispatcher_host.cc
index 6bd92ff06ec855add0444916369fcf8507ef2049..23cba24513ebb32c1d3f9973a365f0a0bd4a8958 100644
--- a/content/browser/speech/input_tag_speech_dispatcher_host.cc
+++ b/content/browser/speech/input_tag_speech_dispatcher_host.cc
@@ -28,14 +28,22 @@ InputTagSpeechDispatcherHost::InputTagSpeechDispatcherHost(
     : BrowserMessageFilter(SpeechRecognitionMsgStart),
       is_guest_(is_guest),
       render_process_id_(render_process_id),
-      url_request_context_getter_(url_request_context_getter) {
+      url_request_context_getter_(url_request_context_getter),
+      weak_factory_(this) {
   // Do not add any non-trivial initialization here, instead do it lazily when
   // required (e.g. see the method |SpeechRecognitionManager::GetInstance()|) or
   // add an Init() method.
 }
 
 InputTagSpeechDispatcherHost::~InputTagSpeechDispatcherHost() {
-  SpeechRecognitionManager::GetInstance()->AbortAllSessionsForListener(this);
+  SpeechRecognitionManager::GetInstance()->AbortAllSessionsForRenderProcess(
+      render_process_id_);
+  weak_factory_.InvalidateWeakPtrs();

[tommi (sloooow) - chröme, 2014/02/18 12:34:18]

This should always be invalid when we get to the destructor, right?
I.e. OnChannelClosing should have been called first.

[Tommy Widenflycht, 2014/02/18 14:23:30]

Done.

+}
+
+base::WeakPtr<InputTagSpeechDispatcherHost>
+InputTagSpeechDispatcherHost::AsWeakPtr() {
+  return weak_factory_.GetWeakPtr();

[tommi (sloooow) - chröme, 2014/02/18 12:34:18]

could add a dcheck for the IO thread here.

[Tommy Widenflycht, 2014/02/18 14:23:30]

Done.

 }
 
 bool InputTagSpeechDispatcherHost::OnMessageReceived(
@@ -61,8 +69,12 @@ void InputTagSpeechDispatcherHost::OverrideThreadForMessage(
     *thread = BrowserThread::UI;
 }
 
+void InputTagSpeechDispatcherHost::OnChannelClosing() {
+  weak_factory_.InvalidateWeakPtrs();
+}
+
 void InputTagSpeechDispatcherHost::OnStartRecognition(
-    const InputTagSpeechHostMsg_StartRecognition_Params& params) {  
+    const InputTagSpeechHostMsg_StartRecognition_Params& params) {
   InputTagSpeechHostMsg_StartRecognition_Params input_params(params);
   int render_process_id = render_process_id_;
   // The chrome layer is mostly oblivious to BrowserPlugin guests and so it
@@ -124,7 +136,7 @@ void InputTagSpeechDispatcherHost::StartRecognitionOnIO(
   config.initial_context = context;
   config.url_request_context_getter = url_request_context_getter_.get();
   config.filter_profanities = filter_profanities;
-  config.event_listener = this;
+  config.event_listener = this->AsWeakPtr();

[tommi (sloooow) - chröme, 2014/02/18 12:34:18]

remove this->

[Tommy Widenflycht, 2014/02/18 14:23:30]

Done.

 
   int session_id = SpeechRecognitionManager::GetInstance()->CreateSession(
       config);