bluetooth: Don't call methods of WebContentsImpl while it's being destroyed.

content/browser/web_contents/web_contents_impl.cc

Index: content/browser/web_contents/web_contents_impl.cc
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index bfdda50f69c982a5208572a106e7b34157cfed2d..9af6a49e77fb8baa22813abed24b6cf20be2c599 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -1217,23 +1217,6 @@ void WebContentsImpl::SetAudioMuted(bool mute) {
   NotifyNavigationStateChanged(INVALIDATE_TYPE_TAB);
 }
 
-void WebContentsImpl::IncrementBluetoothConnectedDeviceCount() {
-  // Notify for UI updates if the state changes.
-  bluetooth_connected_device_count_++;
-  if (bluetooth_connected_device_count_ == 1) {
-    NotifyNavigationStateChanged(INVALIDATE_TYPE_TAB);
-  }
-}
-
-void WebContentsImpl::DecrementBluetoothConnectedDeviceCount() {
-  // Notify for UI updates if the state changes.
-  DCHECK(bluetooth_connected_device_count_ != 0);
-  bluetooth_connected_device_count_--;
-  if (bluetooth_connected_device_count_ == 0) {
-    NotifyNavigationStateChanged(INVALIDATE_TYPE_TAB);
-  }
-}
-
 bool WebContentsImpl::IsConnectedToBluetoothDevice() const {
   return bluetooth_connected_device_count_ > 0;
 }
@@ -5006,6 +4989,33 @@ void WebContentsImpl::NotifyFindReply(int request_id,
   }
 }
 
+void WebContentsImpl::IncrementBluetoothConnectedDeviceCount() {
+  // Trying to update invalidate the tab state while being destroyed

[Jeffrey Yasskin, 2016/06/06 20:32:20]

grammar: "update invalidate"

[ortuno, 2016/06/06 22:38:05]

Done.

+  // could result in a use after free.
+  if (IsBeingDestroyed()) {
+    return;
+  }
+  // Notify for UI updates if the state changes.
+  bluetooth_connected_device_count_++;
+  if (bluetooth_connected_device_count_ == 1) {
+    NotifyNavigationStateChanged(INVALIDATE_TYPE_TAB);
+  }
+}
+
+void WebContentsImpl::DecrementBluetoothConnectedDeviceCount() {
+  // Trying to update invalidate the tab state while being destroyed

[Jeffrey Yasskin, 2016/06/06 20:32:20]

grammar: "update invalidate"

[ortuno, 2016/06/06 22:38:05]

Done. Sorry!

+  // could result in a use after free.
+  if (IsBeingDestroyed()) {
+    return;
+  }
+  // Notify for UI updates if the state changes.
+  DCHECK(bluetooth_connected_device_count_ != 0);
+  bluetooth_connected_device_count_--;
+  if (bluetooth_connected_device_count_ == 0) {
+    NotifyNavigationStateChanged(INVALIDATE_TYPE_TAB);
+  }
+}
+
 #if defined(OS_ANDROID)
 void WebContentsImpl::NotifyFindMatchRectsReply(
     int version,