Ignore filtered event if an event matcher cannot be added.

extensions/renderer/event_bindings.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/renderer/event_bindings.h"
 
 #include <stdint.h>
 
 #include <map>
 #include <memory>
@@ skipping 254 matching lines @@
         content::V8ValueConverter::create());
     std::unique_ptr<base::Value> filter_value(converter->FromV8Value(
         v8::Local<v8::Object>::Cast(args[1]), context()->v8_context()));
     if (!filter_value || !filter_value->IsType(base::Value::TYPE_DICTIONARY)) {
       args.GetReturnValue().Set(static_cast<int32_t>(-1));
       return;
     }
     filter = base::DictionaryValue::From(std::move(filter_value));
   }
 
-  // Hold onto a weak reference to |filter| so that it can be used after passing
-  // ownership to |event_filter|.
-  base::DictionaryValue* filter_weak = filter.get();
   int id = g_event_filter.Get().AddEventMatcher(
       event_name, ParseEventMatcher(std::move(filter)));
+  if (id == -1) {
+    args.GetReturnValue().Set(static_cast<int32_t>(-1));
+    return;
+  }
   attached_matcher_ids_.insert(id);
 
   // Only send IPCs the first time a filter gets added.
+  const EventMatcher* matcher = g_event_filter.Get().GetEventMatcher(id);
+  DCHECK(matcher);
+  base::DictionaryValue* filter_weak = matcher->value();
   std::string extension_id = context()->GetExtensionID();
   if (AddFilter(event_name, extension_id, *filter_weak)) {
     bool lazy = ExtensionFrameHelper::IsContextForEventPage(context());
     content::RenderThread::Get()->Send(new ExtensionHostMsg_AddFilteredListener(
         extension_id, event_name, *filter_weak, lazy));
   }
 
   args.GetReturnValue().Set(static_cast<int32_t>(id));
 }
 
@@ skipping 67 matching lines @@
   // Same for filtered events.
   std::set<int> attached_matcher_ids_safe = attached_matcher_ids_;
   for (int matcher_id : attached_matcher_ids_safe) {
     DetachFilteredEvent(matcher_id, false /* is_manual */);
   }
   DCHECK(attached_matcher_ids_.empty())
       << "Filtered events cannot be attached during invalidation";
 }
 
 }  // namespace extensions