Fix nullptr dereference in MojoShellConnectionImpl

content/common/mojo/mojo_shell_connection_impl.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/mojo/mojo_shell_connection_impl.h"
 
 #include <queue>
 #include <utility>
 #include <vector>
 
@@ skipping 160 matching lines @@
   }
 
   void ShutDownOnIOThread() {
     DCHECK(io_thread_checker_.CalledOnValidThread());
 
     weak_factory_.InvalidateWeakPtrs();
 
     // Note that this method may be invoked by MessageLoopObserver observing
     // MessageLoop destruction. In that case, this call to ShutDown is
     // effectively a no-op. In any case it's safe.
-    message_loop_observer_->ShutDown();
-    message_loop_observer_ = nullptr;
+    if (message_loop_observer_) {
+      message_loop_observer_->ShutDown();
+      message_loop_observer_ = nullptr;
+    }
 
     // Resetting the ServiceContext below may otherwise release the last
     // reference to this IOThreadContext. We keep it alive until the stack
     // unwinds.
     scoped_refptr<IOThreadContext> keepalive(this);
 
     factory_bindings_.CloseAllBindings();
     service_context_.reset();
 
     base::AutoLock lock(lock_);
@@ skipping 295 matching lines @@
 
 void MojoShellConnectionImpl::GetInterface(
     shell::mojom::InterfaceProvider* provider,
     const std::string& interface_name,
     mojo::ScopedMessagePipeHandle request_handle) {
   provider->GetInterface(interface_name, std::move(request_handle));
 }
 
 }  // namespace content