bluetooth: Don't call methods of WebContentsImpl while it's being destroyed.

content/browser/bluetooth/frame_connected_bluetooth_devices.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/bluetooth/frame_connected_bluetooth_devices.h"
 
 #include "base/strings/string_util.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/web_contents.h"
 #include "device/bluetooth/bluetooth_gatt_connection.h"
@@ skipping 81 matching lines @@
     return std::string();
   }
   std::string device_id = device_address_iter->second;
   CHECK(device_address_to_id_map_.erase(device_address));
   CHECK(device_id_to_connection_map_.erase(device_id));
   DecrementDevicesConnectedCount();
   return device_id;
 }
 
 void FrameConnectedBluetoothDevices::IncrementDevicesConnectedCount() {
+  // There are no cases in which IncrementDevicesConnectedCount could be
+  // called while WebContentsImpl's destructor is running.
+  DCHECK(!web_contents_impl_->IsBeingDestroyed());

[Jeffrey Yasskin, 2016/06/06 16:55:36]

Because this has security implications, make it a CHECK.

[ortuno, 2016/06/06 18:25:16]

Done.

   web_contents_impl_->IncrementBluetoothConnectedDeviceCount();
 }
 
 void FrameConnectedBluetoothDevices::DecrementDevicesConnectedCount() {
+  if (web_contents_impl_->IsBeingDestroyed()) {

[Jeffrey Yasskin, 2016/06/06 16:55:36]

Would it make more sense to put this check in
WebContentsImpl::DecrementBluetoothConnectedDeviceCount()? It's still alive at
this point, and can protect itself against calling out to its clients.

[ortuno, 2016/06/06 18:25:16]

I think so. Done.

+    return;
+  }
   web_contents_impl_->DecrementBluetoothConnectedDeviceCount();
 }
 
 }  // namespace content