Avoid UAF on ConnectionFilter impls

content/child/child_thread_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/child/child_thread_impl.h"
 
 #include <signal.h>
 #include <string>
 #include <utility>
 
@@ skipping 239 matching lines @@
   platform_channel.reset(mojo::edk::PlatformHandle(
       base::GlobalDescriptors::GetInstance()->Get(kMojoIPCChannel)));
 #endif
   // Mojo isn't supported on all child process types.
   // TODO(crbug.com/604282): Support Mojo in the remaining processes.
   if (!platform_channel.is_valid())
     return;
   mojo::edk::SetParentPipeHandle(std::move(platform_channel));
 }
 
-class ChannelBootstrapFilter
-    : public ConnectionFilter,
-      public shell::InterfaceFactory<IPC::mojom::ChannelBootstrap> {
+class ChannelBootstrapFilter : public ConnectionFilter {
  public:
   explicit ChannelBootstrapFilter(IPC::mojom::ChannelBootstrapPtrInfo bootstrap)
-      : bootstrap_(std::move(bootstrap)) {}
+      : bootstrap_(std::move(bootstrap)), weak_factory_(this) {}
 
  private:
   // ConnectionFilter:
   bool OnConnect(const shell::Identity& remote_identity,
                  shell::InterfaceRegistry* registry,
                  shell::Connector* connector) override {
     if (remote_identity.name() != kBrowserMojoApplicationName)
       return false;
 
-    registry->AddInterface<IPC::mojom::ChannelBootstrap>(this);
+    registry->AddInterface(base::Bind(&ChannelBootstrapFilter::CreateBootstrap,
+                                      weak_factory_.GetWeakPtr()));
     return true;
   }
 
-  // shell::InterfaceFactory<IPC::mojom::ChannelBootstrap>:
-  void Create(const shell::Identity& remote_identity,
-              IPC::mojom::ChannelBootstrapRequest request) override {
+  void CreateBootstrap(IPC::mojom::ChannelBootstrapRequest request) {
     DCHECK(bootstrap_.is_valid());
     mojo::FuseInterface(std::move(request), std::move(bootstrap_));
   }
 
   IPC::mojom::ChannelBootstrapPtrInfo bootstrap_;
+  base::WeakPtrFactory<ChannelBootstrapFilter> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(ChannelBootstrapFilter);
 };
 
 }  // namespace
 
 ChildThread* ChildThread::Get() {
   return ChildThreadImpl::current();
 }
 
@@ skipping 552 matching lines @@
 void ChildThreadImpl::EnsureConnected() {
   VLOG(0) << "ChildThreadImpl::EnsureConnected()";
   base::Process::Current().Terminate(0, false);
 }
 
 bool ChildThreadImpl::IsInBrowserProcess() const {
   return static_cast<bool>(browser_process_io_runner_);
 }
 
 }  // namespace content