CastTransportIPC can send messages to uninitialized channel id.

chrome/renderer/media/cast_transport_ipc.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/media/cast_transport_ipc.h"
 
 #include <memory>
 #include <utility>
 
 #include "base/callback.h"
 #include "base/id_map.h"
 #include "chrome/common/cast_messages.h"
 #include "chrome/renderer/media/cast_ipc_dispatcher.h"
 #include "ipc/ipc_channel_proxy.h"
 #include "media/cast/cast_sender.h"
 
 CastTransportIPC::CastTransportIPC(
     const net::IPEndPoint& local_end_point,
     const net::IPEndPoint& remote_end_point,
     std::unique_ptr<base::DictionaryValue> options,
     const media::cast::PacketReceiverCallback& packet_callback,
     const media::cast::CastTransportStatusCallback& status_cb,
     const media::cast::BulkRawEventsCallback& raw_events_cb)
-    : packet_callback_(packet_callback),
+    : channel_id_(-1),
+      packet_callback_(packet_callback),
       status_callback_(status_cb),
       raw_events_callback_(raw_events_cb) {
   if (CastIPCDispatcher::Get()) {
+    // TODO: CastIPCDispatcher should be provided as a ctor argument.

[miu, 2016/11/21 21:11:54]

nit: In Chromium, TODO comments should have author logins (so we know who to
poke). Since I asked for this, feel free to make this:

  // TODO(miu): CastIPCDispatcher should be provided as a ctor argument.

     channel_id_ = CastIPCDispatcher::Get()->AddSender(this);
+    Send(new CastHostMsg_New(channel_id_, local_end_point, remote_end_point,
+                             *options));
   }
-  Send(new CastHostMsg_New(channel_id_, local_end_point, remote_end_point,
-                           *options));
 }
 
 CastTransportIPC::~CastTransportIPC() {
-  Send(new CastHostMsg_Delete(channel_id_));
+  if (channel_id_ != -1) {

[miu, 2016/11/21 21:11:54]

nit: This check isn't needed either (since Send() checks for the -1 value).

+    Send(new CastHostMsg_Delete(channel_id_));
+  }
   if (CastIPCDispatcher::Get()) {
     CastIPCDispatcher::Get()->RemoveSender(channel_id_);
   }
 }
 
 void CastTransportIPC::InitializeStream(
     const media::cast::CastTransportRtpConfig& config,
     std::unique_ptr<media::cast::RtcpObserver> rtcp_observer) {
   if (rtcp_observer) {
     DCHECK(clients_.find(config.ssrc) == clients_.end());
@@ skipping 123 matching lines @@
     // TODO(hubbe): Perhaps an non-ownership-transferring cb here?
     std::unique_ptr<media::cast::Packet> packet_copy(
         new media::cast::Packet(packet));
     packet_callback_.Run(std::move(packet_copy));
   } else {
     DVLOG(1) << "CastIPCDispatcher::OnReceivedPacket no packet callback yet.";
   }
 }
 
 void CastTransportIPC::Send(IPC::Message* message) {
-  if (CastIPCDispatcher::Get()) {
+  if (CastIPCDispatcher::Get() && channel_id_ != -1) {
     CastIPCDispatcher::Get()->Send(message);
   } else {
     delete message;
   }
 }