Web Speech API: Fix a race condition causing renderer crash.

content/browser/speech/speech_recognition_manager_impl.cc

Index: content/browser/speech/speech_recognition_manager_impl.cc
diff --git a/content/browser/speech/speech_recognition_manager_impl.cc b/content/browser/speech/speech_recognition_manager_impl.cc
index 2c1b31735a9a7b7cee90417df2edaefdd9a27c6a..9942e11d85e3e6b0fa0ce06f8c2f222bc2b266b8 100644
--- a/content/browser/speech/speech_recognition_manager_impl.cc
+++ b/content/browser/speech/speech_recognition_manager_impl.cc
@@ -184,10 +184,12 @@ void SpeechRecognitionManagerImpl::RecognitionAllowedCallback(int session_id,
   if (!SessionExists(session_id))
     return;
 
+  SessionsTable::iterator iter = sessions_.find(session_id);
+  DCHECK(iter != sessions_.end());

[tommi (sloooow) - chröme, 2013/10/02 08:01:14]

DCHECK_NE?

[Primiano Tucci (use gerrit), 2013/10/02 14:09:01]

Hmm I tried (see patchset 2 trybots) but DCHECK_NE templates don't seem to cope
well with the map::iterator cast operator. And doing the explicit task is less
readable. Reverting to the != DCHECK.

+  Session *session = iter->second;

[tommi (sloooow) - chröme, 2013/10/02 08:01:14]

Session* session = iter->second;

[Primiano Tucci (use gerrit), 2013/10/02 14:09:01]

Oh, right. 

+
   if (ask_user) {
-    SessionsTable::iterator iter = sessions_.find(session_id);
-    DCHECK(iter != sessions_.end());
-    SpeechRecognitionSessionContext& context = iter->second->context;
+    SpeechRecognitionSessionContext& context = session->context;
     context.label = media_stream_manager_->MakeMediaAccessRequest(
         context.render_process_id,
         context.render_view_id,
@@ -207,7 +209,7 @@ void SpeechRecognitionManagerImpl::RecognitionAllowedCallback(int session_id,
                    weak_factory_.GetWeakPtr(),
                    session_id,
                    EVENT_START));
-  } else {
+  } else if (!session->abort_requested) {
     OnRecognitionError(session_id, SpeechRecognitionError(
         SPEECH_RECOGNITION_ERROR_NOT_ALLOWED));
     base::MessageLoop::current()->PostTask(
@@ -253,6 +255,11 @@ void SpeechRecognitionManagerImpl::AbortSession(int session_id) {
   SessionsTable::iterator iter = sessions_.find(session_id);
   iter->second->ui.reset();
 
+  if (iter->second->abort_requested)
+    return;
+
+  iter->second->abort_requested = true;
+
   base::MessageLoop::current()->PostTask(
       FROM_HERE,
       base::Bind(&SpeechRecognitionManagerImpl::DispatchEvent,
@@ -674,6 +681,7 @@ void SpeechRecognitionManagerImpl::ShowAudioInputSettings() {
 
 SpeechRecognitionManagerImpl::Session::Session()
   : id(kSessionIDInvalid),
+    abort_requested(false),
     listener_is_active(true) {
 }