Invalidate WeakPtrs of ResourceMessageFilter on channel shutdown

content/browser/loader/resource_message_filter.cc

Index: content/browser/loader/resource_message_filter.cc
diff --git a/content/browser/loader/resource_message_filter.cc b/content/browser/loader/resource_message_filter.cc
index 677fc9462b85e8d8eee6bc82a10b7d1510873c50..433886826393cb9ab0a593f37d27d52be650af8a 100644
--- a/content/browser/loader/resource_message_filter.cc
+++ b/content/browser/loader/resource_message_filter.cc
@@ -27,6 +27,7 @@ ResourceMessageFilter::ResourceMessageFilter(
       BrowserAssociatedInterface<mojom::URLLoaderFactory>(this, this),
       child_id_(child_id),
       process_type_(process_type),
+      is_channel_closed_(false),
       appcache_service_(appcache_service),
       blob_storage_context_(blob_storage_context),
       file_system_context_(file_system_context),
@@ -34,12 +35,21 @@ ResourceMessageFilter::ResourceMessageFilter(
       get_contexts_callback_(get_contexts_callback),
       weak_ptr_factory_(this) {}
 
-ResourceMessageFilter::~ResourceMessageFilter() {}
+ResourceMessageFilter::~ResourceMessageFilter() {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK(is_channel_closed_);
+  DCHECK(!weak_ptr_factory_.HasWeakPtrs());
+}
 
 void ResourceMessageFilter::OnChannelClosing() {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+
   // Unhook us from all pending network requests so they don't get sent to a
   // deleted object.
   ResourceDispatcherHostImpl::Get()->CancelRequestsForProcess(child_id_);
+
+  weak_ptr_factory_.InvalidateWeakPtrs();
+  is_channel_closed_ = true;
 }
 
 bool ResourceMessageFilter::OnMessageReceived(const IPC::Message& message) {
@@ -62,7 +72,7 @@ void ResourceMessageFilter::GetContexts(
 
 base::WeakPtr<ResourceMessageFilter> ResourceMessageFilter::GetWeakPtr() {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  return weak_ptr_factory_.GetWeakPtr();
+  return is_channel_closed_ ? nullptr : weak_ptr_factory_.GetWeakPtr();
 }
 
 void ResourceMessageFilter::CreateLoaderAndStart(