Check that RWHI isn't deleted manually while owned by a scoped_ptr in RVHI

content/browser/renderer_host/render_widget_host_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 
 #include <math.h>
 #include <set>
 #include <utility>
 
@@ skipping 1451 matching lines @@
     view_.reset();
   }
 
   process_->RemoveRoute(routing_id_);
   g_routing_id_widget_map.Get().erase(
       RenderWidgetHostID(process_->GetID(), routing_id_));
 
   if (delegate_)
     delegate_->RenderWidgetDeleted(this);
 
-  if (also_delete)
+  if (also_delete) {
+    CHECK(!owner_delegate_);

[nasko, 2016/03/01 17:13:43]

Is the goal of this to help us discover further UaF bugs?

[gzobqq, 2016/03/01 18:30:13]

I would guess that if there is a way to fail this check, it won't happen by
accident. At least bug 590284 required deliberate steps from a compromised
renderer. RWHI ownership logic is fairly complicated. RWHI can be owned by RVHI,
RFHI or a WCI. Many paths call RWHI::Destroy(true). Should something get
confused and call it on a RWHI owned by RVHI, we'll UaF. I think the CHECK is a
good idea for protection.

Of course on the other hand it's not nice to clutter the code with CHECKs and
there's a perf hit. If you think we shouldn't have it, that's ok. I'll try to
verify the Destroy(true) calls at some point.

     delete this;
+  }
 }
 
 void RenderWidgetHostImpl::RendererIsUnresponsive() {
   NotificationService::current()->Notify(
       NOTIFICATION_RENDER_WIDGET_HOST_HANG,
       Source<RenderWidgetHost>(this),
       NotificationService::NoDetails());
   is_unresponsive_ = true;
   if (delegate_)
     delegate_->RendererUnresponsive(this);
@@ skipping 769 matching lines @@
 }
 
 #if defined(OS_WIN)
 gfx::NativeViewAccessible
     RenderWidgetHostImpl::GetParentNativeViewAccessible() {
   return delegate_ ? delegate_->GetParentNativeViewAccessible() : NULL;
 }
 #endif
 
 }  // namespace content