bluetooth: Don't call methods of WebContentsImpl while it's being destroyed.

content/browser/bluetooth/frame_connected_bluetooth_devices.cc

Index: content/browser/bluetooth/frame_connected_bluetooth_devices.cc
diff --git a/content/browser/bluetooth/frame_connected_bluetooth_devices.cc b/content/browser/bluetooth/frame_connected_bluetooth_devices.cc
index 164579237b6effafeca34e8bc7e1296ca12b4133..d0b1c694e243e6acdae72433c9d6960f262d7992 100644
--- a/content/browser/bluetooth/frame_connected_bluetooth_devices.cc
+++ b/content/browser/bluetooth/frame_connected_bluetooth_devices.cc
@@ -99,10 +99,16 @@ std::string FrameConnectedBluetoothDevices::CloseConnectionToDeviceWithAddress(
 }
 
 void FrameConnectedBluetoothDevices::IncrementDevicesConnectedCount() {
+  // There are no cases in which IncrementDevicesConnectedCount could be
+  // called while WebContentsImpl's destructor is running.
+  DCHECK(!web_contents_impl_->IsBeingDestroyed());

[Jeffrey Yasskin, 2016/06/06 16:55:36]

Because this has security implications, make it a CHECK.

[ortuno, 2016/06/06 18:25:16]

Done.

   web_contents_impl_->IncrementBluetoothConnectedDeviceCount();
 }
 
 void FrameConnectedBluetoothDevices::DecrementDevicesConnectedCount() {
+  if (web_contents_impl_->IsBeingDestroyed()) {

[Jeffrey Yasskin, 2016/06/06 16:55:36]

Would it make more sense to put this check in
WebContentsImpl::DecrementBluetoothConnectedDeviceCount()? It's still alive at
this point, and can protect itself against calling out to its clients.

[ortuno, 2016/06/06 18:25:16]

I think so. Done.

+    return;
+  }
   web_contents_impl_->DecrementBluetoothConnectedDeviceCount();
 }