CastTransportIPC can send messages to uninitialized channel id.

chrome/renderer/media/cast_transport_ipc.cc

Index: chrome/renderer/media/cast_transport_ipc.cc
diff --git a/chrome/renderer/media/cast_transport_ipc.cc b/chrome/renderer/media/cast_transport_ipc.cc
index 518610fd3c41775523a5dbf9ca5a9372da43edde..51a8c6c32abf6f9952997cbff8888b389f3e545c 100644
--- a/chrome/renderer/media/cast_transport_ipc.cc
+++ b/chrome/renderer/media/cast_transport_ipc.cc
@@ -21,18 +21,22 @@ CastTransportIPC::CastTransportIPC(
     const media::cast::PacketReceiverCallback& packet_callback,
     const media::cast::CastTransportStatusCallback& status_cb,
     const media::cast::BulkRawEventsCallback& raw_events_cb)
-    : packet_callback_(packet_callback),
+    : channel_id_(-1),
+      packet_callback_(packet_callback),
       status_callback_(status_cb),
       raw_events_callback_(raw_events_cb) {
   if (CastIPCDispatcher::Get()) {
+    // TODO: CastIPCDispatcher should be provided as a ctor argument.

[miu, 2016/11/21 21:11:54]

nit: In Chromium, TODO comments should have author logins (so we know who to
poke). Since I asked for this, feel free to make this:

  // TODO(miu): CastIPCDispatcher should be provided as a ctor argument.

     channel_id_ = CastIPCDispatcher::Get()->AddSender(this);
+    Send(new CastHostMsg_New(channel_id_, local_end_point, remote_end_point,
+                             *options));
   }
-  Send(new CastHostMsg_New(channel_id_, local_end_point, remote_end_point,
-                           *options));
 }
 
 CastTransportIPC::~CastTransportIPC() {
-  Send(new CastHostMsg_Delete(channel_id_));
+  if (channel_id_ != -1) {

[miu, 2016/11/21 21:11:54]

nit: This check isn't needed either (since Send() checks for the -1 value).

+    Send(new CastHostMsg_Delete(channel_id_));
+  }
   if (CastIPCDispatcher::Get()) {
     CastIPCDispatcher::Get()->RemoveSender(channel_id_);
   }
@@ -176,7 +180,7 @@ void CastTransportIPC::OnReceivedPacket(const media::cast::Packet& packet) {
 }
 
 void CastTransportIPC::Send(IPC::Message* message) {
-  if (CastIPCDispatcher::Get()) {
+  if (CastIPCDispatcher::Get() && channel_id_ != -1) {
     CastIPCDispatcher::Get()->Send(message);
   } else {
     delete message;